{"action":"Upgrade taskflow-ai to 2.1.9 or later.","affected":[{"fixed":"2.1.9","introduced":"0"}],"component":"taskflow-ai","cve_ids":["CVE-2026-5831"],"ecosystem":"npm","epss":0.01817,"exploited":false,"fixed_versions":["2.1.9"],"ghsa_id":"GHSA-3xp3-pr8x-f755","id":"tcs_01M5KEYP062RGA3FZ5SE7F2BQS","modified_at":"2026-04-10T19:41:27.687300Z","published_at":"2026-04-09T03:31:14Z","references":["https://osv.dev/vulnerability/GHSA-3xp3-pr8x-f755","https://nvd.nist.gov/vuln/detail/CVE-2026-5831","https://github.com/Agions/taskflow-ai/issues/2","https://github.com/Agions/taskflow-ai/commit/c1550b445b9f24f38c4414e9a545f5f79f23a0fe","https://github.com/Agions/taskflow-ai","https://github.com/Agions/taskflow-ai/releases/tag/v2.1.9","https://vuldb.com/submit/789515","https://vuldb.com/vuln/356278","https://vuldb.com/vuln/356278/cti"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-3xp3-pr8x-f755","url":"https://osv.dev/vulnerability/GHSA-3xp3-pr8x-f755"}],"summary":"Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts"}