ai-sdlc MCP Server EUVD-2026-110836

The ai-sdlc MCP server (through 0.31.2) must be running and exposing the check-issue and/or check-pr-status tools, and the attacker must control the 'repo' argument passed to them - realistically achieved by prompt-injecting the AI agent that invokes the MCP server, since the description attributes exploitation to 'prompt-injected agents'. The injection point is the unvalidated repo value interpolated into 'gh issue view' / 'gh pr view' executed via execSync(). Limiting factors: the CVSS vector is local (AV:L) and requires low privileges (PR:L), i.e. the ability to invoke the MCP tool, not open remote network access; there is no user-interaction requirement (UI:N). Commands execute with the privileges of the MCP server user, so impact is bounded by that account.

The vendor-supplied CVSS 4.0 vector (8.5, High) encodes a local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and high impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H) with no scope change to other systems (SC:N/SI:N/SA:N). The AV:L and PR:L metrics are the key tempering signals: this is not a remote, unauthenticated internet-facing flaw but an OS command injection reachable by whoever (or whatever agent) can feed the 'repo' argument into the MCP server's check-issue/check-pr-status tools, which the description frames as a prompt-injected AI agent triggering execSync() interpolation. No EPSS score and no KEV listing are present in the input, so there is no evidence of active or widespread exploitation; by the precision rules this is 'no public exploit identified at time of analysis' (a VulnCheck advisory and the patch commit are referenced, but no reference is marked as working exploit code). The vuln.today decision label is 'this_week' - not act_now or emergency - which aligns with a genuinely serious code-execution bug that is nonetheless gated behind local/agent-mediated access rather than mass-exploitable remotely. Net: a real priority to patch promptly (a patch is available), but the high CVSS is driven by impact rather than by easy reachability, and the practical trigger depends on an attacker controlling the agent or the repo input.

An attacker who can influence the AI agent driving the ai-sdlc MCP server (for example via prompt injection in a document, issue, or PR the agent processes) induces the agent to call the check-issue or check-pr-status tool with a 'repo' value containing shell metacharacters. Because the unvalidated value is string-interpolated into a 'gh issue view' / 'gh pr view' command executed through execSync(), the injected metacharacters run arbitrary OS commands as the MCP server user. No public exploit is identified at time of analysis, though VulnCheck published an advisory and the fixing commit is public.