Threats affecting pkg:github/aiyiyi121/sxdevops

CVE-2026-93971 is an information disclosure vulnerability in aiyiyi121 SxDevOps versions 1.0 and 1.1. The issue exists in an unknown function within the file backend/sxdevops/settings.py and can be exploited remotely without authentication. The vendor has released a patch to fix this vulnerability.

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. The attack may be performed from remote. The patch is identified as 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be carried out remotely. The identifier of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of the file backend/aiops/services.py of the component Command Handler. Performing a manipulation of the argument command results in command injection. Remote exploitation of the attack is possible. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVE-2026-93966 is a command injection vulnerability in aiyiyi121 SxDevOps versions 1.0 and 1.1. It affects the function paramiko.SSHClient.exec_command in the backend/ops/host_tasks.py file within the TASK_RUN_COMMAND component. The vulnerability allows remote attackers to inject commands via manipulation of the command argument. The vendor has released a patch to fix this issue.

CVE-2026-93965 is a command injection vulnerability in aiyiyi121 SxDevOps versions 1.0 and 1.1. The flaw exists in the subprocess.Popen function within the backend/aiops/services.py file of the MCP STDIO Server Management component. This vulnerability allows remote attackers to manipulate the argument endpoint_or_command, leading to command injection. The vendor has released a patch to fix this issue.