| Título | a2aproject a2a-js ≤ 1.1.0 CWE-362 |
|---|
| Descrição | ResultManager.applyStatusUpdate assigns task.status = structuredClone(updateEvent.status) unconditionally, so a late update can roll a COMPLETED, FAILED, CANCELED or REJECTED task back to a non-terminal state. cancelTask loads, checks, sets CANCELED and saves with no lock, so a racing COMPLETED write can be clobbered. Both paths let an agent or a concurrent client rewrite the recorded outcome of a finished task, so a caller relying on terminality to authorise follow-up actions can be made to act on a task whose state no longer reflects what actually happened. |
|---|
| Fonte | ⚠️ https://github.com/a2aproject/a2a-js/pull/636 |
|---|
| Utilizador | colorfullbz (UID 86308) |
|---|
| Submissão | 06/10/2026 07h52 (há 22 dias) |
|---|
| Moderação | 27/10/2026 17h46 (21 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 427455 [a2aproject a2a-js até 1.1.0 Task Status Update result_manager.ts ResultManager.applyStatusUpdate Condição de Corrida] |
|---|
| Pontos | 20 |
|---|