Threats affecting pkg:github/awwaiid/mcp-server-taskwarrior

CVE-2026-5833 is a command injection vulnerability in the awwaiid mcp-server-taskwarrior product versions up to 1.0.1. The issue exists in the server.setRequestHandler function within index.ts, where manipulation of the Identifier argument can lead to command injection. Exploitation requires local access. The vendor has released a fixed version promptly after being notified, and a patch is available to resolve this issue. The vulnerability has a medium severity rating with a CVSS score of 4.8.