Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93965

aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection

CVSS 4.0 5.1 MEDIUMCVSS 3.1 6.6 MEDIUMCVSS 3.0 6.6 MEDIUMCVSS 2.0 5.8 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93965

Published

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93965

Published

SxDevOps

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "aiyiyi121",
                    "product": "SxDevOps",
                    "versions": [
                        {
                            "version": "1.0",
                            "status": "affected"
                        },
                        {
                            "version": "1.1",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:aiyiyi121:sxdevops:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "MCP STDIO Server Management"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON