Read the docs
TI-2026-83858 Aliases CVE-2026-120492GHSA-xhx7-9vjr-p2h8

Chainlit SSRF via Semicolon Path Segment in MCP allowed_urls

Priority MEDIUM 61CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Chainlit 2.12.0 contains a server-side request forgery vulnerability (CWE-918) that lets unauthenticated attackers bypass path-scoped MCP allowed_urls entries. validate_mcp_url does not reject the semicolon character, so attackers can submit MCP URLs with '..;' segments to the /mcp endpoint. On origins that strip semicolon path parameters, these requests reach paths outside the operator's grant. The CVSS 4.0 base score is 6.3 (MEDIUM), CISA's SSVC record lists exploitation as poc, and the issue is not in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00221 12th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ChainlitChainlit2.12.0—No fix listedCNA
  • Chainlit VendorChainlit Affected 2.12.0 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for Chainlit 2.12.0 (status no_fix_listed). Check the advisory for updates before relying on path-scoped allowed_urls entries.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120492
  2. 2026-11-02 Alias added: GHSA-xhx7-9vjr-p2h8
  3. 2026-11-04 Priority changed: MEDIUM → LOW
  4. 2026-11-07 CISA SSVC decision points changed
  5. 2026-11-07 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 2

  • TI-2026-32874 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution CVSS 3.1CRITICAL 9.8
  • TI-2026-17828 Chainlit < 2.9.4 Arbitrary File Read via /project/element CVSS 4.0HIGH 7.1
  • TI-2026-56755 Chainlit Feedback Endpoints Missing Ownership Validation CVSS 4.0MEDIUM 6.0
  • TI-2026-17829 Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element CVSS 4.0HIGH 8.3
  • TI-2026-58900 Chainlit through 2.12.0 Path Traversal via socket.io sessionId CVSS 4.0HIGH 8.8
  • TI-2026-40492 Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration CVSS 4.0HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences