CVE-2026-5833

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5833
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5833.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5833
Aliases
Published
2026-04-09T02:15:14Z
Modified
2026-10-21T02:58:47Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injection
Details

A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1. This impacts the function server.setRequestHandler of the file index.ts. Such manipulation of the argument Identifier leads to command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The name of the patch is 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-77"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5833.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "1.0.0"
                        },
                        {
                            "last_affected":  "1.0.0"
                        },
                        {
                            "introduced":  "1.0.1"
                        },
                        {
                            "last_affected":  "1.0.1"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "last_affected":  "1.0.1"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/awwaiid/mcp-server-taskwarrior

Affected ranges

Type
GIT
Repo
https://github.com/awwaiid/mcp-server-taskwarrior
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5833.json"