High severity · published Oct 27, 2026
CVE-2026-117558
ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status
New
7.8
CVSS
–
EPSS
No
On KEV
Description
The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
ai-sdlc · ai-sdlc-framework
through 0.31.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117558
github.com
https://github.com/ai-sdlc-framework/ai-sdlc
github.com
https://github.com/ai-sdlc-framework/ai-sdlc/blob/ai-sdlc-plugin-v0.31.2/ai-sdlc-plugin/mcp-server/src/tools/check-issue.ts#L15-L19
github.com
https://github.com/ai-sdlc-framework/ai-sdlc/commit/717d7ecf068b714f65955e50fcf5cb4f9a0b5070
github.com
https://github.com/ai-sdlc-framework/ai-sdlc/issues/1970
www.vulncheck.com
https://www.vulncheck.com/advisories/ai-sdlc-mcp-server-through-0.31.2-command-injection-via-check-issue-and-check-pr-status