Mcp Server Taskwarrior
Monthly
Command injection in awwaiid mcp-server-taskwarrior up to version 1.0.1 allows local authenticated attackers to execute arbitrary system commands via manipulation of the Identifier argument in the server.setRequestHandler function of index.ts. Publicly available exploit code exists, and the vendor has released a patched version following responsible disclosure practices. This is a locally-exploitable vulnerability requiring authenticated access with moderate CVSS severity (5.3), but the presence of public exploit code and low attack complexity elevates practical risk.
Command injection in awwaiid mcp-server-taskwarrior up to version 1.0.1 allows local authenticated attackers to execute arbitrary system commands via manipulation of the Identifier argument in the server.setRequestHandler function of index.ts. Publicly available exploit code exists, and the vendor has released a patched version following responsible disclosure practices. This is a locally-exploitable vulnerability requiring authenticated access with moderate CVSS severity (5.3), but the presence of public exploit code and low attack complexity elevates practical risk.