A vulnerability, which was classified as critical, was found in awwaiid mcp-server-taskwarrior up to 1.0.1. This impacts the function
server.setRequestHandler of the file index.ts. Such manipulation of the argument Identifier leads to command injection.
This vulnerability is listed as CVE-2026-5833. The attack must be carried out locally. In addition, an exploit is available.
Applying a patch is advised to resolve this issue.
The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
