Threats tagged 'ghsa-f89j-j8x9-5xwf'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	8.5	CVE-2026-117558The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to High8.52026-10-27GCVE DatabaseCVE-2026-117558 The ai-sdlc plugin MCP server up to version 0.31.2 has an OS command injection vulnerability. This flaw allows attackers to execute arbitrary commands by injecting shell metacharacters into the 'repo' argument. The vulnerability arises because the unvalidated 'repo' value is interpolated into 'gh issue view' or 'gh pr view' commands executed via execSync(), enabling command execution as the MCP server user. Report on CVE-2026-117558 Vulnerability CWE-78 #ghsa-f89j-j8x9-5xwf	GCVE Database	2026-10-27

Page 1 of 1