---
id: "CVE-2026-117558"
kind: "vulnerability"
aliases: ["CVE-2026-117558"]
title: "ai-sdlc MCP server: shell metacharacters in repo argument run commands"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-sdlc", "ai-tooling", "coding-agents", "mcp", "node"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-27T14:16:37+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:32:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117558", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# ai-sdlc MCP server: shell metacharacters in repo argument run commands

The ai-sdlc plugin's MCP server passes its repo argument unvalidated into gh issue view and gh pr view commands run through execSync. An attacker who supplies shell metacharacters in that argument, including through a prompt-injected agent, runs arbitrary commands as the MCP server user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ai-sdlc plugin version (unknown how to query it from the sources); versions through `0.31.2` are affected.
- Look for ai-sdlc MCP server processes or configs in agent setups (Claude Code, Cursor and similar) and confirm which version is installed.

## Fix

- Upgrade the ai-sdlc plugin past `0.31.2` (fixed version unknown from the sources).
- Until patched, remove the ai-sdlc MCP server from agent configurations or restrict the agent's ability to call it.

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117558

## From the sources

The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_