CVE-2026-118128

MediumCVSS 6.5/10Last modified Oct 28, 2026

Description

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
a2aproject	a2a-js	1.0; 1.1.0

References

Timeline

Published: Oct 27, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1181296.3A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function is CVE-2026-118137.8A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated us CVE-2026-1181319.8GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\Pro CVE-2026-1181326.1NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of exte CVE-2026-1181377.8Improper authorization in Windows FTP Service allows an authorized attacker to elevate privileges locally.CVE-2026-1181387.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized a CVE-2026-118146.8A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify l CVE-2026-1181405.5Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.CVE-2026-1181418.8Stack-based buffer overflow in Windows Client for NFS allows an unauthorized attacker to execute code over a network.CVE-2026-1181427.8Out-of-bounds read in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.CVE-2026-1181436.8Out-of-bounds read in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1181446.6Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.