PT-2026-31565 · Agions · Taskflow-Ai

Brucejin · CVE-2026-5831 · Published 2026-04-09 · Updated 2026-04-10

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Agions taskflow-ai versions through 2.1.8

Description A security flaw exists in Agions taskflow-ai up to version 2.1.8. The issue impacts an unknown function within the src/mcp/server/handlers.ts file of the terminal execute component, leading to OS command injection. The attack can be carried out remotely.

Recommendations Upgrade to version 2.1.9 to resolve this issue.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-5831

GHSA-3XP3-PR8X-F755

Affected Products

Taskflow-Ai

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5831.json · Exploit
• https://github.com/Agions/taskflow-ai/commit/c1550b445b9f24f38c4414e9a545f5f79f23a0fe · Patch
• https://github.com/Agions/taskflow-ai/releases/tag/v2.1.9 · Patch
• https://osv.dev/vulnerability/CVE-2026-5831 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3xp3-pr8x-f755 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5831 · Security Note
• https://github.com/Agions/taskflow-ai/issues/2 · Note
• https://github.com/Agions/taskflow-ai · Note
• https://twitter.com/VulmonFeeds/status/2042090699105915372 · Twitter Post
• https://twitter.com/CVEnew/status/2042101286837883203 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042103621966295368 · Twitter Post
• https://vuldb.com/submit/789515 · Note
• https://vuldb.com/vuln/356278 · Note
• https://vuldb.com/vuln/356278/cti · Note
• https://twitter.com/CVEarity/status/2042477073542041834 · Twitter Post