| Título | a2aproject a2a-js ≤ 1.1.0 CWE-362 |
|---|
| Descripción | ResultManager.applyStatusUpdate assigns task.status = structuredClone(updateEvent.status) unconditionally, so a late update can roll a COMPLETED, FAILED, CANCELED or REJECTED task back to a non-terminal state. cancelTask loads, checks, sets CANCELED and saves with no lock, so a racing COMPLETED write can be clobbered. Both paths let an agent or a concurrent client rewrite the recorded outcome of a finished task, so a caller relying on terminality to authorise follow-up actions can be made to act on a task whose state no longer reflects what actually happened. |
|---|
| Fuente | ⚠️ https://github.com/a2aproject/a2a-js/pull/636 |
|---|
| Usuario | colorfullbz (UID 86308) |
|---|
| Sumisión | 2026-10-06 07:52 (hace 22 días) |
|---|
| Moderación | 2026-10-27 17:46 (21 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 427455 [a2aproject a2a-js hasta 1.1.0 Task Status Update result_manager.ts ResultManager.applyStatusUpdate condición de carrera] |
|---|
| Puntos | 20 |
|---|