CVE-2026-93967
MediumCVSS 5.5Summary
A vulnerability was found in SxDevOps versions 1.0 and 1.1 in the generate_host_task function of the file backend/aiops/services.py (Command Handler component). Manipulation of the command argument results in command injection, and the attack can be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
Risk Assessment
Command injection may allow an attacker to execute arbitrary commands on the system, risking full server compromise and loss of data confidentiality, integrity, and availability.
Recommendation
Apply patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 as soon as possible and verify that arguments passed to generate_host_task are properly validated.
Other vulnerabilities in SxDevOps
See all- CVE-2026-93971Medium
A weakness has been identified in SxDevOps versions 1.0 and 1.1 in an unknown function of the file backend/sxdevops/settings.py, leading to information disclosure. The attack can be initiated remotely. A patch named 2b4bf8585c3e731e7a8af30801ea46680bc783f9 is available.
- CVE-2026-93970High
A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1 in the file backend/sxdevops/settings.py of the Settings Handler component. The manipulation results in hard-coded credentials. The attack may be performed remotely. The patch is identified as 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
- CVE-2026-93969High
A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1 in the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible remotely. The patch identifier is 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
- CVE-2026-93968Low
A vulnerability was found in SxDevOps versions 1.0/1.1 in the update function of backend/rbac/serializers.py, within the UserSerializer component. Input manipulation can lead to improper privilege management, and the attack can be executed remotely. The vendor was notified and quickly released a fixed version (patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9).
- CVE-2026-93966Medium
A vulnerability has been found in SxDevOps versions 1.0 and 1.1 in the paramiko.SSHClient.exec_command function of the file backend/ops/host_tasks.py (TASK_RUN_COMMAND component). Manipulation of the command argument leads to command injection, and the attack may be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
- CVE-2026-93965Medium
A flaw has been found in SxDevOps versions 1.0 and 1.1 in the subprocess.Popen function of the file backend/aiops/services.py (MCP STDIO Server Management component). Manipulation of the endpoint_or_command argument causes command injection, and the attack may be initiated remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
Original NVD description (English source)
A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of the file backend/aiops/services.py of the component Command Handler. Performing a manipulation of the argument command results in command injection. Remote exploitation of the attack is possible. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.