CVE-2026-45018
CriticalCVSS 9.8Summary
Chainlit from 2.4.0rc0 to 2.12.0, when features.mcp.enabled is set to true, exposes the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string, and validation only checks the executable name, allowing arbitrary command execution via the -c argument in npx.
Risk Assessment
An unauthenticated attacker can execute arbitrary commands in the context of the Chainlit process, potentially leading to application takeover and data access.
Recommendation
Update Chainlit to version 2.12.0 or later. If not using MCP, disable this feature in the configuration.
Original NVD description (English source)
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.