The flaw resides in the server.setRequestHandler function in index.ts, where the Identifier argument is accepted without proper validation. A crafted value can inject shell commands that the server executes, allowing a local attacker to run arbitrary code on the host with the privileges of the mcp‑server‑taskwarrior process. The weakness maps to CWE‑74 (Improper Neutralization of Input During Web Page Generation) and CWE‑77 (Improper Access Control).

The vulnerability affects the awwaiid mcp‑server‑taskwarrior package in all releases up to 1.0.1. Users running those versions on their local infrastructure are susceptible; any machine where the service is deployed locally can be impacted.

The CVSS base score of 4.8 indicates a moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting limited known exploitation. However, the public disclosure and the confirmed command‑injection capability mean that a local attacker, such as an insider or a compromised local process, could leverage this flaw. The exploitation requires local access to generate a crafted request to the server, reducing the risk of widespread remote attacks.