GHSA-95hg-3c55-xf9x

Suggest an improvement
Source
https://github.com/advisories/GHSA-95hg-3c55-xf9x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-95hg-3c55-xf9x/GHSA-95hg-3c55-xf9x.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-95hg-3c55-xf9x
Aliases
  • CVE-2026-5833
Published
2026-04-09T06:30:27Z
Modified
2026-04-10T19:41:26Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
awwaiid mcp-server-taskwarrior vulnerable to command injection
Details

A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1. This impacts the function server.setRequestHandler of the file index.ts. Such manipulation of the argument Identifier leads to command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The name of the patch is 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific 
{
    "cwe_ids":  [
        "CWE-74"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-10T19:20:15Z",
    "nvd_published_at":  "2026-04-09T04:17:16Z",
    "severity":  "LOW"
}
References

Affected packages

npm / mcp-server-taskwarrior

Package

Name
mcp-server-taskwarrior
View open source insights on deps.dev
Purl
pkg:npm/mcp-server-taskwarrior

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.0.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-95hg-3c55-xf9x/GHSA-95hg-3c55-xf9x.json"