CVE-2026-76893: falha de média gravidade em tsparticles
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an mcp-session-id claims the shared transport state, causing later independent clients to receive Server already initialized and preventing them from establishing sessions until the process restarts. The first client's session remains functional. This issue is fixed in version 4.3.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVEs relacionadas — tsparticles
No mesmo produto, das mais perigosas para as menos.
CVE-2026-63655HIGHtsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSEPSS 0.4%CVE-2026-76826HIGHtsParticles: Generated release notes can execute shell commands in the stable publish workflowEPSS 0.3%CVE-2026-76892HIGHtsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processEPSS 0.3%