CVE-2026-117558: ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status
The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running the ai-sdlc plugin MCP server through 0.31.2 are exposed when an agent can invoke the check_issue or check_pr_status functionality and influence its repo argument. Commands execute with the privileges of the MCP server user.
What does an attacker need to exploit it?
An attacker needs to supply shell metacharacters in the repo argument passed to check_issue or check_pr_status. The issue specifically notes prompt-injected agents as a path for causing the vulnerable command execution.
Are the affected commands limited to a particular integration?
The vulnerable paths build and execute gh issue view or gh pr view commands using execSync(). The unvalidated repo value is interpolated into those OS command strings.