CVE-2026-93967: aiyiyi121 SxDevOps Command services.py generate_host_task command injection
A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generatehosttask of the file backend/aiops/services.py of the component Command Handler. Performing a manipulation of the argument command results in command injection. Remote exploitation of the attack is possible. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aiyiyi121 SxDevOpsto a version that resolves this vulnerability.Patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9
Event History
Frequently Asked Questions
What access is required to exploit this issue?
The attack can be performed remotely, but the attacker requires low privileges and user interaction, according to the supplied CVSS vector. Exploitation involves controlling the command argument handled by generate_host_task.
What security impact can successful exploitation have?
Successful exploitation is rated as having low impact on confidentiality, integrity, and availability. The vulnerability allows command injection through the affected Command Handler function.
What should teams do if they are running an affected release?
Apply patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying the patch is the recommended remediation provided in the advisory.