Junglewise Threat Intelligence

CVE-2026-5833: awwaiid mcp-server-taskwarrior command injection in setRequestHandler

CVE-2026-5833 · Severity: medium · CVSS 5.3 · Published 2026-04-09

Vendors: npm.

Executive brief

A security vulnerability exists in the TaskWarrior Model Context Protocol (MCP) server, a tool that allows AI assistants to manage local tasks. An attacker can exploit this flaw to run unauthorized commands on the host computer by providing specially crafted task identifiers or descriptions. This could lead to full system compromise, data theft, or unauthorized modification of the user's environment.

Technical details

The mcp-server-taskwarrior library is vulnerable to command injection within the server.setRequestHandler function in index.ts. The root cause is the unsafe use of child_process.execSync, which executes shell commands constructed via string interpolation of user-controlled parameters (such as identifier, description, project, and tags). An attacker can inject shell metacharacters (e.g., semicolons or pipes) into these parameters to execute arbitrary commands with the privileges of the MCP server process. The vulnerability affects the mark_task_done, add_task, and get_next_tasks tools. A fix is available in commit 1ee3d28, which migrates the implementation to use execFileSync with argument arrays to prevent shell interpretation.

Affected products

  • awwaiid mcp-server-taskwarrior up to 1.0.1

Timeline

  • 2026-03-12: disclosed: Issue reported on GitHub repository
  • 2026-04-09: advisory: NVD/VulDB advisory published
  • 2026-04-09: patched: Vendor released fixed version and patch commit 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2

References