{"data":{"id":"d81490cb-8f32-414a-9306-0f76624e76ca","title":"GHSA-22jm-h49p-29qw: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","summary":"Affected versions of the MCP TypeScript SDK (@modelcontextprotocol/sdk 1.24.0 through 1.31.0) did not check which session created an experimental task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Only servers that pass taskStore to McpServer or Server are affected.","solution":"Upgrade to @modelcontextprotocol/sdk 1.32.0 or later. If you cannot upgrade yet, remove taskStore, or create one InMemoryTaskStore per session.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-22jm-h49p-29qw","publishedAt":"2026-10-20T18:26:54.000Z","cveId":"CVE-2026-111767","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@modelcontextprotocol/sdk@>= 1.24.0, < 1.32.0 (fixed: 1.32.0)"],"affectedPackageNames":["@modelcontextprotocol/sdk"],"affectedPackageRefs":["npm:@modelcontextprotocol/sdk"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["MCP TypeScript SDK","@modelcontextprotocol/sdk"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-21T00:11:14.888Z","kevDateAdded":null,"advisoryAliases":["GHSA-22jm-h49p-29qw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-20T18:26:54.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}