Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Chainlit | chainlit | 2.4.0rc0 to before 2.12.0 | 2.12.0 | Patch available | CNA |
| — | chainlit (PyPI) | 2.4.0rc0 to before 2.12.0 | 2.12.0 | Patch available | GHSA-w3fx-mc44-mf6j |
- chainlit VendorChainlit Affected 2.4.0rc0 to before 2.12.0 Fixed in 2.12.0 Patch available CNA
- chainlit (PyPI) Vendor— Affected 2.4.0rc0 to before 2.12.0 Fixed in 2.12.0 Patch available GHSA-w3fx-mc44-mf6j
Remediation
- Fix · CNA chainlit (Chainlit) Fixed in 2.12.0
- Fix · GHSA-w3fx-mc44-mf6j chainlit (PyPI) Fixed in 2.12.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45018
- 2026-10-03 Alias added: GHSA-w3fx-mc44-mf6j
References
Other 5
- https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j
- https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9
- https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-001--command-injection-via-mcp-stdio
- https://github.com/Chainlit/chainlit/releases/tag/2.12.0
- https://github.com/Chainlit/chainlit
More Chainlit vulnerabilities
- TI-2026-17828 Chainlit < 2.9.4 Arbitrary File Read via /project/element CVSS 4.0HIGH 7.1
- TI-2026-83858 Chainlit SSRF via Semicolon Path Segment in MCP allowed_urls CVSS 4.0MEDIUM 6.3
- TI-2026-56755 Chainlit Feedback Endpoints Missing Ownership Validation CVSS 4.0MEDIUM 6.0
- TI-2026-17829 Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element CVSS 4.0HIGH 8.3
- TI-2026-58900 Chainlit through 2.12.0 Path Traversal via socket.io sessionId CVSS 4.0HIGH 8.8
- TI-2026-40492 Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration CVSS 4.0HIGH 8.8
Sources
- CVE-2026-45018 · CVE Program
- CVE-2026-45018 · NVD
- FIRST EPSS
- GHSA-w3fx-mc44-mf6j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences