awwaiid mcp-server-taskwarrior vulnerable to command injection
A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1. This impacts the function server.setRequestHandler of the file index.ts. Such manipulation of the argument Identifier leads to command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The name of the patch is 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | mcp-server-taskwarrior | <= 1.0.1 | no fix |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-5833
- https://github.com/awwaiid/mcp-server-taskwarrior/issues/8
- https://github.com/awwaiid/mcp-server-taskwarrior/issues/8#issuecomment-4139402095
- https://github.com/awwaiid/mcp-server-taskwarrior/commit/1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2
- https://github.com/awwaiid/mcp-server-taskwarrior
- https://github.com/user-attachments/files/25923228/mcp-server-taskwarrior_bug.pdf
- https://vuldb.com/submit/789810
- https://vuldb.com/vuln/356289
- https://vuldb.com/vuln/356289/cti
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-74- Platform
- npm
- Package
mcp-server-taskwarrior- Disclosed
- 09.04.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-95hg-3c55-xf9x - CC BY 4.0
Vulnerability history: mcp-server-taskwarrior
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.