CVE-2026-93965: SxDevOps passes an MCP STDIO endpoint string straight into subprocess.Popen

NVD·medium signalXBlueskyLinkedInCopy link

Published 2026-09-20, this flaw in aiyiyi121 SxDevOps 1.0 and 1.1 lets a remote attacker inject commands through the `endpoint_or_command` argument reaching `subprocess.Popen` in `backend/aiops/services.py`, the component that manages MCP STDIO servers. NVD scores it 5.8 (CVSS v2) and the fix is commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9. The shape is the recurring one for STDIO MCP management UIs: the server command is user-supplied config, and anything that renders it to a shell is an RCE.