GitHub Advisoryadvisory · npm

GHSA-95hg-3c55-xf9x awwaiid mcp-server-taskwarrior vulnerable to command injection

LOW Published 2026-04-09 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-5833
Ecosystem
npm
Packages
mcp-server-taskwarrior
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-74
Reviewed
2026-04-10

Affected packages

• npm mcp-server-taskwarrior: <= 1.0.1 (no fix yet)

Description

A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1. This impacts the function server.setRequestHandler of the file index.ts. Such manipulation of the argument Identifier leads to command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The name of the patch is 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Related

Alias · CVE (1)

  • CVE-2026-5833 A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References