npm/mcp-server-taskwarrior CVE-2026-5833: medium 5.3, EPSS 0.74%
awwaiid mcp-server-taskwarrior vulnerable to command injection
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.0.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-95hg-3c55-xf9x
- https://nvd.nist.gov/vuln/detail/CVE-2026-5833
- https://github.com/awwaiid/mcp-server-taskwarrior/issues/8
- https://github.com/awwaiid/mcp-server-taskwarrior/issues/8#issuecomment-4139402095
- https://github.com/awwaiid/mcp-server-taskwarrior/commit/1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2
- https://github.com/awwaiid/mcp-server-taskwarrior
- https://github.com/user-attachments/files/25923228/mcp-server-taskwarrior_bug.pdf
- https://vuldb.com/submit/789810
- https://vuldb.com/vuln/356289
- https://vuldb.com/vuln/356289/cti
CVE-2026-5833 · published · modified · JSON