ai-sdlc MCP Server: OS command injection via repo parameter
Summary
The ai-sdlc plugin MCP server through version 0.31.2 contains an OS command injection vulnerability (CWE-78). The repo argument of the check_issue and check_pr_status tools is passed unvalidated into gh CLI commands run via execSync(). An attacker who can supply shell metacharacters, for example through prompt injection in content an AI agent processes, can execute arbitrary commands as the MCP server user.
Affected
- ai-sdlc-framework ai-sdlc plugin MCP server, versions 0 through 0.31.2
- Tools: check_issue and check_pr_status
Fixed in
Unknown. No fixed version has been confirmed.
Workaround
- No vendor workaround confirmed.
- Disable the MCP server on hosts where it is not essential.
- Run the MCP server and AI agent under a least-privilege OS account with a scoped, read-only GitHub token.
Exploitation
- Not known to be exploited in the wild.
- Public technical details exist in the reporter's issue #1970.
- EPSS: 0.69 % (percentile 53).
- Local attack vector with low privileges required (CVSS 4.0 AV:L/PR:L); exploitation requires a way to feed input to the agent, typically via prompt injection.
Our recommendation
- Check whether the ai-sdlc plugin is installed on developer workstations or CI runners.
- Remove or disable the plugin's MCP server where it is not required.
- Restrict agent tool calls with manual approval and limit GitHub token scope.
- Upgrade to a fixed release once the vendor confirms one, and monitor the vendor repository for security advisories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub repository ai-sdlc-framework/ai-sdlc github.com
- Source file check-issue.ts at ai-sdlc-plugin-v0.31.2 github.com
- Fix commit 717d7ecf068b714f65955e50fcf5cb4f9a0b5070 github.com
- Issue #1970 github.com
- VulnCheck advisory www.vulncheck.com
- Strix CVE record CVE-2026-117558 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:02.
Original description (NVD)
The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.
NVD references (5)
- https://github.com/ai-sdlc-framework/ai-sdlc
- https://github.com/ai-sdlc-framework/ai-sdlc/blob/ai-sdlc-plugin-v0.31.2/ai-sdlc-plugin/mcp-server/src/tools/…
- https://github.com/ai-sdlc-framework/ai-sdlc/commit/717d7ecf068b714f65955e50fcf5cb4f9a0b5070
- https://github.com/ai-sdlc-framework/ai-sdlc/issues/1970
- https://www.vulncheck.com/advisories/ai-sdlc-mcp-server-through-0.31.2-command-injection-via-check-issue-and-…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.