Ai Sdlc
Monthly
OS command injection in the ai-sdlc plugin MCP server (versions through 0.31.2) allows an attacker who can control the 'repo' argument of the check-issue or check-pr-status tools to run arbitrary shell commands with the privileges of the MCP server user. The unvalidated repo value is interpolated into 'gh issue view' / 'gh pr view' strings executed through execSync(), so a prompt-injected AI agent invoking the tool can turn a crafted repository name into command execution on the host. The vendor has published a fix (commit 717d7ec) and the issue is tracked as EUVD-2026-110836; no public exploit code was identified at time of analysis, and priority guidance places remediation in the current week (this_week).
OS command injection in the ai-sdlc plugin MCP server (versions through 0.31.2) allows an attacker who can control the 'repo' argument of the check-issue or check-pr-status tools to run arbitrary shell commands with the privileges of the MCP server user. The unvalidated repo value is interpolated into 'gh issue view' / 'gh pr view' strings executed through execSync(), so a prompt-injected AI agent invoking the tool can turn a crafted repository name into command execution on the host. The vendor has published a fix (commit 717d7ec) and the issue is tracked as EUVD-2026-110836; no public exploit code was identified at time of analysis, and priority guidance places remediation in the current week (this_week).