CVE-2026-5831

MEDIUM

Agions taskflow-ai terminal_execute handlers.ts os command injection

Title source: cna
STIX 2.1

Description

A security flaw has been discovered in Agions taskflow-ai up to 2.1.8. This impacts an unknown function of the file src/mcp/server/handlers.ts of the component terminal_execute. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. Upgrading to version 2.1.9 will fix this issue. The patch is named c1550b445b9f24f38c4414e9a545f5f79f23a0fe. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

References (7)

Core 7
Core References
Vdb Entry vdb-entry
VDB-356278 | Agions taskflow-ai terminal_execute handlers.ts os command injection
https://vuldb.com/vuln/356278
Signature, Permissions Required signature permissions-required
VDB-356278 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/356278/cti
Third Party Advisory third-party-advisory
Submit #789515 | Agions taskflow-ai 2.1.8 Command Injection
https://vuldb.com/submit/789515
Issue Tracking issue-tracking
https://github.com/Agions/taskflow-ai/issues/2

Scores

CVSS v3 6.3
EPSS 0.0111
EPSS Percentile 61.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (11)
Agions/taskflow-ai 2.1.0
Agions/taskflow-ai 2.1.1
Agions/taskflow-ai 2.1.2
Agions/taskflow-ai 2.1.3
Agions/taskflow-ai 2.1.4
Agions/taskflow-ai 2.1.5
Agions/taskflow-ai 2.1.6
Agions/taskflow-ai 2.1.7
Agions/taskflow-ai 2.1.8
Agions/taskflow-ai 2.1.9
... and 1 more
Published Apr 09, 2026
Tracked Since Apr 09, 2026