VulnSocial

CVE-2026-117558

LOWCVSS 8.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-28: 110-28
Referenced assets1 URL
Full discourse1 post
  • ThreatAft@ThreatAft

    🔐 The MCP Command Injection Wave — Nine Servers, Eight Without a Fix, and a Scoring Model That Hides the Risk Between 13:07 and 13:08 UTC on October 27, 2026, VulnCheck published nine CVE records covering nine 🔗 https://threataft.com/articles/mcp-server-command-injection-wave-cve-2026-117558-117573?utm_source=twitter&utm_medium=social&utm_campaign=share #CyberSecurity #ThreatIntel

    0100041
    52 followersView on X

Explore more

Back to dashboard