GHSA-22jm-h49p-29qw

Source

https://github.com/advisories/GHSA-22jm-h49p-29qw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-22jm-h49p-29qw/GHSA-22jm-h49p-29qw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-22jm-h49p-29qw

Aliases

CVE-2026-111767

Published

2026-10-20T18:26:54Z

Modified

2026-10-20T18:45:09Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator

Summary

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

Details

Summary

In affected versions, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks.

Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them.

Am I affected?

Only if your HTTP server passes taskStore to McpServer or Server. If grep -ri taskstore --exclude-dir=node_modules . finds nothing, you are not affected.

Affected versions: @modelcontextprotocol/sdk 1.24.0 through 1.31.0. The 2.x packages are not affected.

Fix

Upgrade to @modelcontextprotocol/sdk 1.32.0 or later. Each task is now tied to the session that created it, so a client that starts a new session can no longer reach its earlier tasks.

If you cannot upgrade yet, remove taskStore, or create one InMemoryTaskStore per session.

Database specific

{
    "cwe_ids":  [
        "CWE-639",
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-20T18:26:54Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / @modelcontextprotocol/sdk

Package

Name: @modelcontextprotocol/sdk; View open source insights on deps.dev
Purl: pkg:npm/%40modelcontextprotocol/sdk

Affected ranges

Type: SEMVER
Events: Introduced

1.24.0

Fixed

1.32.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-22jm-h49p-29qw/GHSA-22jm-h49p-29qw.json"