ROOT-APP-PYPI-CVE-2026-45018 CVE-2026-45018 in chainlit - Patched by Root

Root has patched CVE-2026-45018 in the chainlit package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-45019 CVE-2026-45019 in chainlit - Patched by Root

Root has patched CVE-2026-45019 in the chainlit package for Root:PyPI. Multiple fixed versions available...

CVE-2026-120492

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowedurls entries because validatemcpurl does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing...

CVE-2026-120492 Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowedurls entries because validatemcpurl does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing...

CVE-2026-120492

Chainlit version 2.12.0 is vulnerable to a Server-Side Request Forgery (SSRF) flaw. The root cause is that the validate_mcp_url function fails to reject the semicolon (;) character . Unauthenticated attackers can submit MCP URLs containing ..; segments to the /mcp endpoint. This allows them to by...

EUVD-2026-115226

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowedurls entries because validatemcpurl does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing...

CVE-2026-120492 Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowedurls entries because validatemcpurl does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing...

CVE-2026-120492: Chainlit: Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass…

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowedurls entries because validatemcpurl does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing...

PT-2026-135482

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed urls entries because validate mcp url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causi...

Chainlit contains a session hijacking vulnerability

Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the...

PYSEC-2026-4028 Chainlit contains a session hijacking vulnerability

Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the...

PT-2026-105788

Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore existin...

agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +5 more potentially affected by CVE-2026-45018 via chainlit (>=2.4.400, <=2.11.1)

chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2026-45018 Source advisory: OSV:PYSEC-2026-3812...

PYSEC-2026-3812 Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +5 more potentially affected by CVE-2026-120492 +1 more via chainlit (>=2.4.400, <=2.11.1)

chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2026-120492, CVE-2026-45019 Source advisory: OSV:PYSEC-2026-3811...

PYSEC-2026-3811 Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected?Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. SummaryWhen MCP is...

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected?Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. SummaryWhen MCP is...

Directory Traversal

Overview chainlit is a Build Conversational AI. Affected versions of this package are vulnerable to Directory Traversal via the client-supplied sessionId handling in backend/chainlit/session.py and backend/chainlit/socket.py. An attacker can delete arbitrary directories accessible to the service...

CVE-2026-86099

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...