Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Am I affected? Only if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: `/mcp` is reachable by any client that can open a session. Summary When MCP is enabled (`features.mcp.enabled = true`), the `POST /mcp` endpoint for `sse` and `streamable-http` transports accepts a user-controlled `url` and optional `headers` dictionary without any validation. An unauthenticated attacker can force the Chainlit server to make outbound HTTP requests to arbitrary URLs — including internal network services and cloud metadata endpoints — with attacker-controlled HTTP headers such as `Authorization` and `Cookie`. Affected / patched versions | | | |---|---| | CVE | CVE-2026-45019 | | Affected — URL-based SSRF | `>=2.4.0rc0, =2.6.4, Breaking change. 2.12.0 changes how MCP servers are configured. If `.chainlit/config.toml` still uses…
Recommended action: Upgrade to 2.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP is enabled (features.mcp.enabled = true), the POST /mcp endpoint for stdio transport accepts a user-controlled fullCommand string. The validatemcpcommand() function checks the executable name against a configurable allowlist but does not inspect or restrict the arguments. An attacker can pass npx -y -c 'ARBITRARY COMMAND' to execute arbitrary shell commands on the server with the privileges of the Chainlit process. Affected / patched versions | | | |---|---| | CVE | CVE-2026-45018 | | Affected | =2.4.0rc0, <2.12.0 with features.mcp.enabled = true (introduced in PR #1977, the change that added MCP support) | | Patched | 2.12.0 (releasing 2026-08-25) | Details validatemcpcommand() in…
Recommended action: Upgrade to 2.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restoreexistingsession path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.
Recommended action: Upgrade to 2.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.
Recommended action: Upgrade to 2.9.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/ , allowing disclosure of any file readable by the Chainlit service.
Recommended action: Upgrade to 2.9.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.
Recommended action: Upgrade to 2.8.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.