CVE-2026-93965
MediumCVSS 6.6Summary
A flaw has been found in SxDevOps versions 1.0 and 1.1 in the subprocess.Popen function of the file backend/aiops/services.py (MCP STDIO Server Management component). Manipulation of the endpoint_or_command argument causes command injection, and the attack may be initiated remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
Risk Assessment
Command injection via the endpoint_or_command argument may allow an attacker to execute arbitrary commands on the system, risking server compromise and loss of control over the environment.
Recommendation
Apply patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 as soon as possible and secure subprocess.Popen calls by validating the endpoint_or_command argument.
Other vulnerabilities in SxDevOps
See all- CVE-2026-93971Medium
A weakness has been identified in SxDevOps versions 1.0 and 1.1 in an unknown function of the file backend/sxdevops/settings.py, leading to information disclosure. The attack can be initiated remotely. A patch named 2b4bf8585c3e731e7a8af30801ea46680bc783f9 is available.
- CVE-2026-93970High
A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1 in the file backend/sxdevops/settings.py of the Settings Handler component. The manipulation results in hard-coded credentials. The attack may be performed remotely. The patch is identified as 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
- CVE-2026-93969High
A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1 in the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible remotely. The patch identifier is 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
- CVE-2026-93968Low
A vulnerability was found in SxDevOps versions 1.0/1.1 in the update function of backend/rbac/serializers.py, within the UserSerializer component. Input manipulation can lead to improper privilege management, and the attack can be executed remotely. The vendor was notified and quickly released a fixed version (patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9).
- CVE-2026-93967Medium
A vulnerability was found in SxDevOps versions 1.0 and 1.1 in the generate_host_task function of the file backend/aiops/services.py (Command Handler component). Manipulation of the command argument results in command injection, and the attack can be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
- CVE-2026-93966Medium
A vulnerability has been found in SxDevOps versions 1.0 and 1.1 in the paramiko.SSHClient.exec_command function of the file backend/ops/host_tasks.py (TASK_RUN_COMMAND component). Manipulation of the command argument leads to command injection, and the attack may be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
Original NVD description (English source)
A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.