ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-117558 · Microsoft / collected KEV context

cve-program · CVE-2026-117558

• https://github.com/ai-sdlc-framework/ai-sdlc/issues/1970
• https://github.com/ai-sdlc-framework/ai-sdlc
• https://github.com/ai-sdlc-framework/ai-sdlc/commit/717d7ecf068b714f65955e50fcf5cb4f9a0b5070
• https://github.com/ai-sdlc-framework/ai-sdlc/blob/ai-sdlc-plugin-v0.31.2/ai-sdlc-plugin/mcp-server/src/tools/check-issue.ts#L15-L19
• https://www.vulncheck.com/advisories/ai-sdlc-mcp-server-through-0.31.2-command-injection-via-check-issue-and-check-pr-status

• ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status · Newly collected advisory · 27 Oct 2026