Executive brief
Taskflow-ai is an npm library used for workflow and task automation. A flaw in its terminal execution handler allows authenticated users to inject arbitrary operating system commands through unsanitized input, potentially leading to unauthorized code execution on systems running the vulnerable library. This could be exploited to steal data, modify files, or compromise the integrity of automated workflows.
Technical details
The vulnerability is an OS command injection flaw (CWE-77) in the terminal_execute handler within src/mcp/server/handlers.ts of taskflow-ai. The vulnerable component fails to properly sanitize user-supplied input before passing it to OS command execution functions, allowing an authenticated attacker to inject arbitrary shell commands. The attack vector is network-based with low attack complexity, though it requires prior authentication (PR:L). Successful exploitation results in remote code execution with the privileges of the process running taskflow-ai, enabling arbitrary system commands. The vendor patched this issue in version 2.1.9 (commit c1550b445b9f24f38c4414e9a545f5f79f23a0fe).
Affected products
- Agions taskflow-ai up to 2.1.8
Timeline
- 2026-04-09: disclosed: Vulnerability published in OSV and NVD
- 2026-04-09: patched: Version 2.1.9 released with fix (commit c1550b445b9f24f38c4414e9a545f5f79f23a0fe)