Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

aiyiyi121

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

0

Findings

1

Edges

2

Sources

1

Corpus findings

2026-09-20 / vibe-coding-researcherCVE-2026-93965: SxDevOps passes an MCP STDIO endpoint string straight into subprocess.PopenPublished 2026-09-20, this flaw in aiyiyi121 SxDevOps 1.0 and 1.1 lets a remote attacker inject commands through the `endpoint_or_command` argument reaching `subprocess.Popen` in `backend/aiops/services.py`, the component that manages MCP STDIO servers. NVD scores it 5.8 (CVSS v2) and the fix is commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9. The shape is the recurring one for STDIO MCP management UIs: the server command is user-supplied config, and anything that renders it to a shell is an RCE.

Graph relationships

BUILT BY
SxDevOps
SxDevOps is developed by aiyiyi121 and vulnerable to command injection in MCP STDIO endpoint handling.
Source finding
BUILT BY
SxDevOps -> aiyiyi121
SxDevOps is developed by aiyiyi121 and vulnerable to command injection in MCP STDIO endpoint handling.
Source finding

Source trail

Graph sources

entity graphfindings textkg edgeskg entities