CVE-2026-118128 Details
Description
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.
A race condition vulnerability has been identified in the a2aproject a2a-js library, specifically in versions through 1.1.0. The issue arises in the Task Status Update Handler component, within the ResultManager.applyStatusUpdate function in src/server/result_manager.ts. This vulnerability allows for improper handling of task status updates, where a late status update could unintentionally revert a task's state from a terminal status back to a non-terminal one, or change it to a different terminal status. Such manipulation could be exploited remotely.
Users are advised to upgrade to version 1.2.0, which addresses the vulnerability by implementing proper checks and synchronization in the task status update process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/a2aproject/a2a-js/ | [email protected] | ProductSource CodeVendor |
| https://github.com/a2aproject/a2a-js/commit/7b87c9480bfa643f9d2b2eaf06988b3d3a95de25 | [email protected] | Source CodeVendor |
| https://github.com/a2aproject/a2a-js/pull/636 | [email protected] | Issue TrackingVendor |
| https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-118128 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1015057 | [email protected] | Permission Required |
| https://vuldb.com/vuln/427455 | [email protected] | Permission Required |
| https://vuldb.com/vuln/427455/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| a2aproject a2a-js | <= 1.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |