{"answers":{"affected":"2 open source packages ship an affected version, including taskflow-ai.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-5831 exists.","fix":"Upgrade taskflow-ai to 2.1.9 or later.","what":"CVE-2026-5831 is a medium-severity vulnerability in Agions taskflow-ai, published on 9 Apr 2026."},"fix_prompt":"Check this codebase for CVE-2026-5831 and fix it if it is affected.\n\nWhat it is: CVE-2026-5831 is a medium-severity vulnerability in Agions taskflow-ai, published on 9 Apr 2026. \nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-5831 exists.\n\nAffected packages and fixed versions:\n- taskflow-ai (npm): affected all versions; fixed in 2.1.9\n- taskflow-ai (npm): affected all versions; fixed in 2.1.9\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-5831/ (Markdown: https://insights.sbomify.com/CVE-2026-5831/index.md)","id":"CVE-2026-5831","markdown":"https://insights.sbomify.com/CVE-2026-5831/index.md","name":"CVE-2026-5831","record":{"aliases":["GHSA-3xp3-pr8x-f755"],"analysis":null,"analysis_generated_by":null,"assigner":"VulDB","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","version":"4.0"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"description":"A security flaw has been discovered in Agions taskflow-ai up to 2.1.8. This impacts an unknown function of the file src/mcp/server/handlers.ts of the component terminal_execute. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. Upgrading to version 2.1.9 will fix this issue. The patch is named c1550b445b9f24f38c4414e9a545f5f79f23a0fe. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Agions taskflow-ai terminal_execute handlers.ts os command injection","id":"CVE-2026-5831","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":7,"next":{"headline":"atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgery","id":"CVE-2026-5832"},"packages":[{"ecosystem":"npm","fixed":["2.1.9"],"introduced":["0"],"last_affected":[],"package":"taskflow-ai","purl":null,"source":"GHSA-3xp3-pr8x-f755"},{"ecosystem":"npm","fixed":["2.1.9"],"introduced":["0"],"last_affected":[],"package":"taskflow-ai","purl":"pkg:npm/taskflow-ai","source":"GHSA-3xp3-pr8x-f755"}],"prev":{"headline":"Tenda AC15 SysToolChangePwd websGetVar stack-based overflow","id":"CVE-2026-5830"},"products":["taskflow-ai"],"published":"2026-04-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-04-09","vendors":["Agions"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-5831/"}