Ai-Sdlc Plugin MCP Server (<= 0.31.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ai-sdlc-plugin-mcp-server--0.31.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 15:49:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgai-sdlc plugin MCP server: OS command injection (CVE-2026-117558)https://feed.craftedsignal.io/briefs/2026-10-ai-sdlc-cmd-injection/Tue, 27 Oct 2026 15:49:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ai-sdlc-cmd-injection/The ai-sdlc plugin MCP server through 0.31.2 is vulnerable to OS command injection via the repo argument, allowing execution of commands by supplying shell metacharacters.<p>The ai-sdlc plugin MCP server through version 0.31.2 contains an OS command injection vulnerability. The repo argument is not validated and is interpolated into gh issue view or gh pr view commands run via execSync(). This allows prompt-injected agents to execute commands as the MCP server user.</p> highadvisorycommand-injectionvulnerabilitymcp-server