CVE-2026-93966: aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection
A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.execcommand of the file backend/ops/hosttasks.py of the component TASKRUNCOMMAND. Such manipulation of the argument command leads to command injection. The attack may be launched remotely. The name of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiyiyi121 SxDevOps TASK_RUN_COMMANDto a version that resolves this vulnerability.Patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have high privileges, as reflected by the PR:H vector. Exploitation can be performed remotely and does not require user interaction.
Which releases are affected and what fixes it?
SxDevOps 1.0 and 1.1 are identified as affected. The available patch is commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9.
What is the potential impact of successful exploitation?
Successful command injection can affect confidentiality, integrity, and availability, each rated Low in the supplied vector. The vulnerable command handling occurs in TASK_RUN_COMMAND within backend/ops/host_tasks.py.