CVE-2026-93966

MEDIUM 4.7

aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backend/ops/host_tasks.py of the component TASK_RUN_COMMAND. Such manipulation of the argument command leads to command injection. The attack may be launched remotely. The name of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CWE	CWE-77 CWE-74
Vendor	aiyiyi121
Product	sxdevops
Published	Sep 20, 2026

Stay Ahead of the Next One

Get instant alerts for aiyiyi121 sxdevops

Be the first to know when new medium vulnerabilities affecting aiyiyi121 sxdevops are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

aiyiyi121 / SxDevOps

1.0 1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/407925 vuldb.com: https://vuldb.com/vuln/407925/cti vuldb.com: https://vuldb.com/cve/CVE-2026-93966 vuldb.com: https://vuldb.com/submit/944377 github.com: https://github.com/aiyiyi121/sxdevops/issues/16 github.com: https://github.com/aiyiyi121/sxdevops/commit/2b4bf8585c3e731e7a8af30801ea46680bc783f9 github.com: https://github.com/aiyiyi121/sxdevops/

Credits

🔍 _lxf (VulDB User) VulDB CNA Team