CVE-2026-111767
CVE-2026-111767 · MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.
CVSS 8.6 · Élevée · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
typescript-sdk
- Versions du logiciel
- >= 1.24.0, < 1.32.0: Concernée
Aucun correctif publié
@modelcontextprotocol/sdk npm
- Plages de versions concernées
- SEMVER: ≥ 1.24.0, < 1.32.0
Mettez à jour vers 1.32.0
Sources originales
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2925
- https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa
- https://nvd.nist.gov/vuln/detail/CVE-2026-111767