The vulnerability is an OS command injection flaw in the terminal_execute handler located in the file src/mcp/server/handlers.ts. An attacker can supply crafted input that the service executes as a shell command, resulting in arbitrary command execution on the host. This grants the attacker the ability to read, modify, or delete data, as well as disrupt or take control of the system. The weakness is expressed by both CWE–77 and CWE–78, which describe command injection and operating‑system command execution, respectively.

All deployments of Agions taskflow‑ai version 2.1.8 or earlier are affected. The issue is resolved in release 2.1.9, identified by the commit hash c1550b445b9f24f38c4414e9a545f5f79f23a0fe.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Because the flaw can be triggered remotely through a publicly accessible endpoint, the likelihood of exploitation is significant if the terminal_execute interface is exposed to untrusted networks.