QwikSec

Security Database

CVE

CWE

Training

CVE-2026-5831

Published: Apr 9, 2026

Modified: Apr 9, 2026

PUBLISHED

CVSS v3.1

6.3

MEDIUM

Description

A security flaw has been discovered in Agions taskflow-ai up to 2.1.8. This impacts an unknown function of the file src/mcp/server/handlers.ts of the component terminal_execute. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. Upgrading to version 2.1.9 will fix this issue. The patch is named c1550b445b9f24f38c4414e9a545f5f79f23a0fe. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Vendor	Product	Versions
Agions	taskflow-ai	affected `2.1.0` affected `2.1.1` affected `2.1.2` affected `2.1.3` affected `2.1.4` +5 more versions

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

References

VDB-356278 | Agions taskflow-ai terminal_execute handlers.ts os command injection

vdb-entry

VDB-356278 | CTI Indicators (IOB, IOC, TTP, IOA)

signature

permissions-required

Submit #789515 | Agions taskflow-ai 2.1.8 Command Injection

third-party-advisory

https://github.com/Agions/taskflow-ai/issues/2

issue-tracking

https://github.com/Agions/taskflow-ai/commit/c1550b445b9f24f38c4414e9a545f5f79f23a0fe

patch

https://github.com/Agions/taskflow-ai/releases/tag/v2.1.9

patch

https://github.com/Agions/taskflow-ai/

product

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.