Home

Description

A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1. This impacts the function server.setRequestHandler of the file index.ts. Such manipulation of the argument Identifier leads to command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The name of the patch is 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

PUBLISHED Reserved 2026-04-08 | Published 2026-04-09 | Updated 2026-04-09 | Assigner VulDB




MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
MEDIUM: 5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
MEDIUM: 5.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
4.3AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Problem types

Command Injection

Injection

Product status

1.0.0
affected

1.0.1
affected

Timeline

2026-04-08:Advisory disclosed
2026-04-08:VulDB entry created
2026-04-08:VulDB entry last update

Credits

Yinci Chen (VulDB User) reporter

VulDB CNA Team coordinator

References

vuldb.com/vuln/356289 (VDB-356289 | awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injection) vdb-entry technical-description

vuldb.com/vuln/356289/cti (VDB-356289 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/submit/789810 (Submit #789810 | awwaiid mcp-server-taskwarrior <=1.0.1 Command Injection) third-party-advisory

github.com/awwaiid/mcp-server-taskwarrior/issues/8 issue-tracking

github.com/awwaiid/mcp-server-taskwarrior/issues/8 issue-tracking

github.com/.../files/25923228/mcp-server-taskwarrior_bug.pdf exploit

github.com/...ommit/1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2 patch

github.com/awwaiid/mcp-server-taskwarrior/ product

cve.org (CVE-2026-5833)

nvd.nist.gov (CVE-2026-5833)

Download JSON