CVE-2026-117558

ai-sdlc MCP tools allow local command injection

ai-sdlc-framework · ai-sdlc plugin MCP server

First documented disclosure · Review checkpoint

Summary

A crafted repository value could make issue and pull-request tools execute an additional host command.

Severity and exploitation evidence

High · 8.5/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe a vulnerability and demonstration, not established malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The repo argument enters a shell command without safe argument separation.

Conditions required

Control of MCP tool arguments in the operator's local session, including through a manipulated agent.

Potential impact

Command execution with the server user's permissions and access to that user's GitHub CLI session.

Affected versions and configurations

Through 0.31.2.

Fix and mitigation status

Fixed by commit 717d7ecf068b714f65955e50fcf5cb4f9a0b5070; a containing release was not established.

Practical next steps

Apply the upstream fix or disable the affected tools; use argument-array process execution and validate repository identifiers.

Operating lesson

Tool schemas must enforce the boundary between repository names and executable instructions.

Evidence and limits

October 23 issue and merged fix predate the October 27 CVE. The maintainer confirms a local-session prerequisite; the issue's network-critical rating is not used.

Sources