PT-2026-31572 · Unknown · Awwaiid Mcp-Server-Taskwarrior

Yinci Chen · Published 2026-04-09 · Updated 2026-04-13 · CVE-2026-5833

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions awwaiid mcp-server-taskwarrior versions up to 1.0.1

Description A security issue exists in awwaiid mcp-server-taskwarrior up to version 1.0.1. The server.setRequestHandler function within the index.ts file is susceptible to command injection through manipulation of the Identifier argument. This requires local access to execute the attack. The patch identified as 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2 addresses this issue.

Recommendations Apply the patch 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2 to resolve this vulnerability.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-5833

GHSA-95HG-3C55-XF9X

Affected Products

Awwaiid Mcp-Server-Taskwarrior

References · 14

• 🔥❌ https://github.com/user-attachments/files/25923228/mcp-server-taskwarrior_bug.pdf · Exploit, Deleted
• https://github.com/awwaiid/mcp-server-taskwarrior/commit/1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5833 · Security Note
• https://osv.dev/vulnerability/GHSA-95hg-3c55-xf9x · Vendor Advisory
• https://github.com/awwaiid/mcp-server-taskwarrior/issues/8 · Note
• https://github.com/awwaiid/mcp-server-taskwarrior/issues/8#issuecomment-4139402095 · Note
• https://github.com/awwaiid/mcp-server-taskwarrior · Note
• https://twitter.com/CVEnew/status/2042101284677861846 · Twitter Post
• https://twitter.com/CVEarity/status/2042496549423604048 · Twitter Post
• https://vuldb.com/submit/789810 · Note
• https://twitter.com/infoflowcloud/status/2042103520250175988 · Twitter Post
• https://vuldb.com/vuln/356289 · Note
• https://vuldb.com/vuln/356289/cti · Note
• https://twitter.com/abcas_mcp_guard/status/2043597345473138969 · Twitter Post