Chainlit vulnerabilities
We track 5 vulnerabilities in Chainlit products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 9, 2026.
Latest Chainlit vulnerabilities
- 8.2 High severity
chainlit: Improper Limitation of a Pathname to a Restricted Directory
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that e
- 7.2 High severity
chainlit: Server-Side Request Forgery
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authent
- 9.8 Critical severity
chainlit: Improper Neutralization of Special Elements used in an OS Command
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authent
- 8.2 High severity
chainlit: Missing Authorization
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Atta
- 7.7 High severity
Chainlit: Server-Side Request Forgery
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Elemen