{"id":"CVE-2026-117558","kind":"vulnerability","aliases":["CVE-2026-117558"],"related":[],"title":"ai-sdlc MCP server: shell metacharacters in repo argument run commands","description":"The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.","summary":"The ai-sdlc plugin's MCP server passes its repo argument unvalidated into gh issue view and gh pr view commands run through execSync. An attacker who supplies shell metacharacters in that argument, including through a prompt-injected agent, runs arbitrary commands as the MCP server user.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-sdlc","ai-tooling","coding-agents","mcp","node"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed ai-sdlc plugin version (unknown how to query it from the sources); versions through `0.31.2` are affected.\n- Look for ai-sdlc MCP server processes or configs in agent setups (Claude Code, Cursor and similar) and confirm which version is installed.","fix":"- Upgrade the ai-sdlc plugin past `0.31.2` (fixed version unknown from the sources).\n- Until patched, remove the ai-sdlc MCP server from agent configurations or restrict the agent's ability to call it.","status":"open","published_at":"2026-10-27T14:16:37+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:32:53+00:00","updated_at":"2026-10-27T14:32:53+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T14:32:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the ai-sdlc plugin past `0.31.2` (fixed version unknown from the sources).\n- Until patched, remove the ai-sdlc MCP server from agent configurations or restrict the agent's ability to call it.","reach":"unknown","title":"ai-sdlc MCP server: shell metacharacters in repo argument run commands","impact":"high","summary":"The ai-sdlc plugin's MCP server passes its repo argument unvalidated into gh issue view and gh pr view commands run through execSync. An attacker who supplies shell metacharacters in that argument, including through a prompt-injected agent, runs arbitrary commands as the MCP server user.","category":"ai-tooling","nicknames":[],"who_cares":["ai-sdlc","mcp","coding-agents","node"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands as the MCP server user.","analyst_note":"Check the NVD entry and the ai-sdlc repository for the fixed version and whether the MCP server is reachable without auth.","how_to_check":"- Check the installed ai-sdlc plugin version (unknown how to query it from the sources); versions through `0.31.2` are affected.\n- Look for ai-sdlc MCP server processes or configs in agent setups (Claude Code, Cursor and similar) and confirm which version is installed.","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Teams running the ai-sdlc plugin's MCP server through version `0.31.2`, typically attached to a coding agent that reads untrusted issue or PR content. Exposure comes from the agent passing repo values to the server, so systems without this plugin installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":3345,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117558':15A,18A '-2026':14A,17A '0.31.2':87C 'agent':27B,70B,130C 'ai':2A,20B,23B,32B,81C 'ai-sdlc':1A,19B,31B,80C 'ai-tool':22B 'allow':95C 'arbitrari':72B 'argument':10A,41B,63B,107C 'attack':56B,96C 'code':26B 'coding-ag':25B 'command':12A,51B,73B,91C,99C,122C,132C 'contain':88C 'cve':13A,16A 'execsync':54B,125C 'execut':98C,131C 'gh':44B,48B,115C,119C 'includ':64B 'inject':69B,92C,129C 'interpol':113C 'issu':45B,116C 'let':126C 'mcp':4A,28B,36B,76B,84C,135C 'metacharact':7A,60B,103C 'node':29B 'os':90C 'pass':38B 'plugin':34B,83C 'pr':49B,120C 'prompt':68B,128C 'prompt-inject':67B,127C 'repo':9A,40B,106C,110C 'run':11A,52B,71B,123C 'sdlc':3A,21B,33B,82C 'server':5A,37B,77B,85C,136C 'shell':6A,59B,102C 'suppli':58B,101C 'tool':24B 'unvalid':42B,109C 'user':78B,137C 'valu':111C 'via':124C 'view':46B,50B,117C,121C 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":"Teams running the ai-sdlc plugin's MCP server through version `0.31.2`, typically attached to a coding agent that reads untrusted issue or PR content. Exposure comes from the agent passing repo values to the server, so systems without this plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117558","severity":null,"published_at":"2026-10-27T14:16:37+00:00","modified_at":"2026-10-27T14:16:37+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}