Log in Start free

Vulnerability · Published Apr 9, 2026 · Assigned by VulDB

CVE-2026-5833awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injection

Medium 5.3

In plain English

A medium-severity command injection in mcp-server-taskwarrior from awwaiid. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 45.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1. This impacts the function server.setRequestHandler of the file index.ts. Such manipulation of the argument Identifier leads to command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The name of the patch is 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmmcp-server-taskwarriorno fix listedGHSA-95hg-3c55-xf9x

Affected products (as reported)

VendorProductVersions
awwaiid mcp-server-taskwarrior 1.0.01.0.1

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References