CVE-2026-5831

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5831
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5831.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5831
Aliases
Published
2026-04-09T01:45:15.048Z
Modified
2026-07-08T08:14:45.085161157Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
Agions taskflow-ai terminal_execute handlers.ts os command injection
Details

A security flaw has been discovered in Agions taskflow-ai up to 2.1.8. This impacts an unknown function of the file src/mcp/server/handlers.ts of the component terminal_execute. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. Upgrading to version 2.1.9 will fix this issue. The patch is named c1550b445b9f24f38c4414e9a545f5f79f23a0fe. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5831.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.1.0"
                },
                {
                    "last_affected": "2.1.0"
                },
                {
                    "introduced": "2.1.8"
                },
                {
                    "last_affected": "2.1.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/agions/taskflow-ai

Affected ranges

Type
GIT
Repo
https://github.com/agions/taskflow-ai
Events
Introduced
bd27f17a192621265bc28a66ba3c90cf00019056
Fixed
c1550b445b9f24f38c4414e9a545f5f79f23a0fe
Fixed
0dffe5e901b258662810053f0988917ab6ec30a2
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.1.1"
        },
        {
            "last_affected": "2.1.1"
        },
        {
            "introduced": "2.1.2"
        },
        {
            "last_affected": "2.1.2"
        },
        {
            "introduced": "2.1.3"
        },
        {
            "last_affected": "2.1.3"
        },
        {
            "introduced": "2.1.4"
        },
        {
            "last_affected": "2.1.4"
        },
        {
            "introduced": "2.1.5"
        },
        {
            "last_affected": "2.1.5"
        },
        {
            "introduced": "2.1.6"
        },
        {
            "last_affected": "2.1.6"
        },
        {
            "introduced": "2.1.7"
        },
        {
            "last_affected": "2.1.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.1.1
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5831.json"