agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +4 more potentially affected by CVE-2026-22218 via chainlit (>=2.4.400, <=2.6.3)

chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2026-22218 Source advisory: SNYK:PYTHON-CHAINLIT-14829575...

Directory Traversal

Overview chainlit is a Build Conversational AI. Affected versions of this package are vulnerable to Directory Traversal via the updatethreadelement and deletethreadelement handlers in backend/chainlit/server.py. An authenticated attacker can read arbitrary files from the server by sending a craft...

agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +4 more potentially affected by CVE-2025-68492 via chainlit (>=2.4.400, <=2.6.3)

chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2025-68492 Source advisory: SNYK:PYTHON-CHAINLIT-14157231...

Authorization Bypass Through User-Controlled Key

Overview chainlit is a Build Conversational AI. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to a missing authorization check when binding a WebSocket session to a user-supplied threadId. An attacker can exploit this weakness by providin...

edubotics-core (>=0.1.3, <=0.1.7) potentially affected by unknown CVE via chainlit (1.2.0)

chainlit PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - edubotics-core =0.1.3, =0.1.7 Source cves: unknown CVE Source advisory: SNYK:PYTHON-CHAINLIT-8320952...

Missing Authorization

Overview chainlit is a Build Conversational AI. Affected versions of this package are vulnerable to Missing Authorization due to improper user verification in the getfile endpoint. This flaw allows unauthorized users to access and retrieve session files by guessing or obtaining valid sessionids,...

Directory Traversal

Overview chainlit is a Build Conversational AI. Affected versions of this package are vulnerable to Directory Traversal via functions like getfile, servefile, and getavatar due to improperly restricting file paths. Attackers can access sensitive files via crafted requests containing malicious pat...