| Title | a2aproject a2a-js ≤ 1.1.0 CWE-362 |
|---|
| Description | ResultManager.applyStatusUpdate assigns task.status = structuredClone(updateEvent.status) unconditionally, so a late update can roll a COMPLETED, FAILED, CANCELED or REJECTED task back to a non-terminal state. cancelTask loads, checks, sets CANCELED and saves with no lock, so a racing COMPLETED write can be clobbered. Both paths let an agent or a concurrent client rewrite the recorded outcome of a finished task, so a caller relying on terminality to authorise follow-up actions can be made to act on a task whose state no longer reflects what actually happened. |
|---|
| Source | ⚠️ https://github.com/a2aproject/a2a-js/pull/636 |
|---|
| User | colorfullbz (UID 86308) |
|---|
| Submission | 10/06/2026 07:52 (23 days ago) |
|---|
| Moderation | 10/27/2026 17:46 (21 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 427455 [a2aproject a2a-js up to 1.1.0 Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition] |
|---|
| Points | 20 |
|---|