CVE-2026-93966: aiyiyi121 SxDevOps command injection in task execution

Executive brief

SxDevOps is an open-source operations automation platform that executes tasks across managed infrastructure. A command injection vulnerability in the task execution component allows remote attackers to inject arbitrary commands through unsanitized user input, potentially enabling unauthorized code execution on managed systems.

Technical details

The vulnerability exists in the TASK_RUN_COMMAND component of backend/ops/host_tasks.py, where the paramiko.SSHClient.exec_command function processes user-controlled command arguments without proper validation or escaping. An attacker can inject shell metacharacters to execute arbitrary commands on remote hosts via SSH. A patch (commit 2b4bf8585c3e731e7a8af30801ea46680bc783f9) has been released by the vendor addressing the input validation.

Affected products

• aiyiyi121 SxDevOps 1.0, 1.1

Timeline

• 2026-09-20: disclosed
• 2026-09-06: patched

References

• https://github.com/aiyiyi121/sxdevops/
• https://github.com/aiyiyi121/sxdevops/commit/2b4bf8585c3e731e7a8af30801ea46680bc783f9