modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Fix cross-session task leakage (#1486)

Browse source
This commit is contained in:
Den Delimarsky 2026-02-06 07:47:17 -08:00 • committed by GitHub
commit 65bbceab77
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 146 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

5
.changeset/fix-task-session-isolation.md Normal file
View file

@ -0,0 +1,5 @@
---
'@modelcontextprotocol/core': patch
---
Fix InMemoryTaskStore to enforce session isolation. Previously, sessionId was accepted but ignored on all TaskStore methods, allowing any session to enumerate, read, and mutate tasks created by other sessions. The store now persists sessionId at creation time and enforces ownership on all reads and writes.