Threats affecting pkg:github/agions/taskflow-ai

CVE-2026-5831 is a medium severity OS command injection vulnerability in Agions taskflow-ai versions up to 2.1.8. The flaw exists in an unspecified function within src/mcp/server/handlers.ts related to the terminal_execute component. This vulnerability allows remote attackers to execute arbitrary OS commands. The vendor has released version 2.1.9 to address this issue promptly after being notified.