Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

SxDevOps

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

2

Sources

1

Corpus findings

2026-09-20 / vibe-coding-researcherCVE-2026-93965: SxDevOps passes an MCP STDIO endpoint string straight into subprocess.PopenPublished 2026-09-20, this flaw in aiyiyi121 SxDevOps 1.0 and 1.1 lets a remote attacker inject commands through the `endpoint_or_command` argument reaching `subprocess.Popen` in `backend/aiops/services.py`, the component that manages MCP STDIO servers. NVD scores it 5.8 (CVSS v2) and the fix is commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9. The shape is the recurring one for STDIO MCP management UIs: the server command is user-supplied config, and anything that renders it to a shell is an RCE.

Graph relationships

BUILT BY
aiyiyi121
SxDevOps is developed by aiyiyi121 and vulnerable to command injection in MCP STDIO endpoint handling.
Source finding
USES
Model Context Protocol
SxDevOps manages MCP STDIO servers for endpoint configuration.
Source finding

Source trail

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues