CVE-2026-117558

The ai-sdlc plugin MCP server through version 0.31.2 is vulnerable to an OS command injection vulnerability (CWE-78). The root cause is the use of execSync() to execute gh issue view or gh pr view commands, where an unvalidated repo argument is interpolated into the shell command. Attackers can s...