Description

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backend/ops/host_tasks.py of the component TASK_RUN_COMMAND. Such manipulation of the argument command leads to command injection. The attack may be launched remotely. The name of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-20T07:16:51.563Z",
  "pubdate": "2026-09-20T07:16:51.563Z",
  "executiveSummary": "A critical command injection vulnerability exists in aiyiyi121 SxDevOps versions 1.0 and 1.1.\nThe vulnerability resides within the TASK_RUN_COMMAND component, specifically in the backend/ops/host_tasks.py file.\nImproper sanitization of user-supplied input passed to the paramiko.SSHClient.exec_command function allows an unauthenticated or authenticated remote attacker to execute arbitrary OS commands on the underlying host system.\nSuccessful exploitation results in full remote code execution, granting the attacker the same privileges as the application process. This poses a significant risk to the integrity, confidentiality, and availability of the server infrastructure, as attackers can gain persistent unauthorized access, exfiltrate sensitive data, or compromise additional network assets.",
  "technicalDetails": "The vulnerability is a classic command injection flaw located within the backend/ops/host_tasks.py file of the SxDevOps platform. The root cause is the insecure handling of user-controlled input that is passed as a command argument to the paramiko.SSHClient.exec_command() function. In Python, the paramiko library's exec_command method executes the provided string as a command on the remote SSH server. If the application directly concatenates or interpolates unsanitized input into this string, the shell environment interpreting the command will treat injected metacharacters as command separators or operators.\nThe attack flow begins when an attacker identifies an endpoint associated with the TASK_RUN_COMMAND component that accepts user input to be executed on remote hosts. By injecting shell-sensitive characters—such as semicolons (;), pipes (|), ampersands (&), or backticks—the attacker can break out of the intended command structure. For example, if the application executes 'echo [input]', an attacker may provide '; cat /etc/passwd' to force the execution of arbitrary system binaries.\nBecause the vulnerability exists at the application layer, the command is executed with the privileges of the user running the SxDevOps backend service. Once the injection is triggered, the payload is executed directly by the remote SSH shell. The technical impact is absolute; once code execution is achieved, an attacker can bypass authorization mechanisms, install web shells, pivot into internal network segments, or deploy ransomware. This flaw does not require physical access and can be executed entirely over the network, making it a high-severity entry point for further compromise.\nThe flaw affects specifically the paramiko.SSHClient.exec_command implementation within the identified Python script, suggesting a failure to utilize parameterized command execution or an allow-list based validation of command parameters prior to invocation."
}