CVE-2026-93965 | aiyiyi121 SxDevOps 1.0/1.1 MCP STDIO Server Management services.py subprocess.Popen endpoint_or_command command injection (Issue 16)

September 19, 2026 Yanac

A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. It has been classified as critical. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection.

This vulnerability appears as CVE-2026-93965. The attack may be initiated remotely. There is no available exploit.

To fix this issue, it is recommended to deploy a patch.

The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.VulDB Recent EntriesRead More