Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93966

aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection

CVSS 4.0 5.1 MEDIUMCVSS 3.1 4.7 MEDIUMCVSS 3.0 4.7 MEDIUMCVSS 2.0 5.8 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93966

Published

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backend/ops/host_tasks.py of the component TASK_RUN_COMMAND. Such manipulation of the argument command leads to command injection. The attack may be launched remotely. The name of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93966

Published

SxDevOps

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "aiyiyi121",
                    "product": "SxDevOps",
                    "versions": [
                        {
                            "version": "1.0",
                            "status": "affected"
                        },
                        {
                            "version": "1.1",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:aiyiyi121:sxdevops:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "TASK_RUN_COMMAND"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON