Chainlit Chainlit vulnerabilities
9 published CVEs name Chainlit Chainlit among the affected products.
- 9Published CVEs9 of them scored
- 9Last 12 monthspublished in the last year
- 1Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-120492
Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls
Chainlit · Chainlit
Medium6.3 - CVE-2026-86099
Chainlit through 2.12.0 Path Traversal via socket.io sessionId
Chainlit · chainlit
High8.8 - CVE-2026-82290
Chainlit Feedback Endpoints Missing Ownership Validation
Chainlit · chainlit
Medium6.0 - CVE-2026-45019
Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access
Chainlit · chainlit
High7.2 - CVE-2026-45018
Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution
Chainlit · chainlit
Critical9.8 - CVE-2026-56104
Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration
Chainlit · chainlit
High8.8 - CVE-2026-22219
Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element
Chainlit · Chainlit
High8.3 - CVE-2026-22218
Chainlit < 2.9.4 Arbitrary File Read via /project/element
Chainlit · Chainlit
High7.1 - CVE-2025-68492
Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be…
Chainlit · Chainlit
Low2.3