high
advisory
ai-sdlc plugin MCP server: OS command injection (CVE-2026-117558)
The ai-sdlc plugin MCP server through 0.31.2 is vulnerable to OS command injection via the repo argument, allowing execution of commands by supplying shell metacharacters.
CVE search metadata
CVE search record: CVE-2026-117558. Severity: high. CVSS: 7.8. KEV: no. Product: ai-sdlc plugin MCP server (<= 0.31.2). Brief: ai-sdlc plugin MCP server: OS command injection (CVE-2026-117558). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ai-sdlc-cmd-injection/
Triage facts
Revision 1- Applicability
- ai-sdlc plugin MCP server (<= 0.31.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 15:49 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The ai-sdlc plugin MCP server through version 0.31.2 contains an OS command injection vulnerability. The repo argument is not validated and is interpolated into gh issue view or gh pr view commands run via execSync(). This allows prompt-injected agents to execute commands as the MCP server user.