CVE-2026-120492

Chainlit from 2.4.0rc0 to 2.12.0, when features.mcp.enabled is set to true, exposes the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string, and validation only checks the executable name, allowing arbitrary command execution via the -c argument in npx.

An SSRF vulnerability in Chainlit before version 2.9.4 allows an authenticated attacker to make arbitrary HTTP requests from the server to internal network services or cloud metadata endpoints via a user-controlled URL in an Element during the /project/element update flow with the SQLAlchemy data layer backend.

A vulnerability in Chainlit versions prior to 2.9.4 allows an authenticated attacker to read arbitrary files on the server by manipulating the path in a project element update request. The attacker can copy the file to their session and then retrieve it using the element identifier.

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.

Chainlit versions from 2.4.0rc0 to 2.12.0, when features.mcp.enabled is set to true, expose the POST /mcp endpoint without authentication. An attacker can control the URL and headers, allowing blind outbound requests to internal or external services, including cloud metadata endpoints, with arbitrary Authorization and Cookie headers. This issue is fixed in version 2.12.0.

Chainlit before version 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.