{"id":"ghsa-ghsa-22jm-h49p-29qw","seq":2404,"kind":"advisory","title":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","url":"https://github.com/advisories/GHSA-22jm-h49p-29qw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-22jm-h49p-29qw","summary":"影響: npm:@modelcontextprotocol/sdk >= 1.24.0, < 1.32.0 → 1.32.0\nSummary In affected versions, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them. Am I affected? Only if your HTTP server passes taskStore to McpServer or Server. If grep -ri taskstore --exclude-dir=node_modules . finds no…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-111767"],"tags":["GHSA-22jm-h49p-29qw","@modelcontextprotocol/sdk"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:26:54.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}