CVE-2026-45018Critical· 9.8▾ MidnightChainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint wi…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
chainlit >= 2.4.0rc0, <= 2.11.1Patched in:
chainlit 2.12.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45019High· 7.2Chainlit is a Python framework for building production-ready conversational AI applications
CVE-2026-56104High· 7.4Chainlit contains a session hijacking vulnerability
CVE-2025-68492Medium· 4.2Chainlit contains an authorization bypass vulnerability
CVE-2026-22219High· 7.7Chainlit contain a server-side request forgery (SSRF) vulnerability
CVE-2026-86099High· 8.2Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences
CVE-2025-15379Critical· 10.0A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function