CVE-2026-86099
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
Risk Assessment
The risk includes unauthorized deletion of data and potential loss of system integrity. An unauthenticated attacker can delete critical directories, potentially leading to service disruption or data loss.
Recommendation
It is recommended to immediately upgrade Chainlit to a version newer than 2.12.0 if a patch is available. Also restrict access to the service and monitor logs for unusual sessionId requests.
Other vulnerabilities in Chainlit
See all- CVE-2026-45018Critical
Chainlit from 2.4.0rc0 to 2.12.0, when features.mcp.enabled is set to true, exposes the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string, and validation only checks the executable name, allowing arbitrary command execution via the -c argument in npx.
- CVE-2026-22219High
An SSRF vulnerability in Chainlit before version 2.9.4 allows an authenticated attacker to make arbitrary HTTP requests from the server to internal network services or cloud metadata endpoints via a user-controlled URL in an Element during the /project/element update flow with the SQLAlchemy data layer backend.
- CVE-2026-22218Medium
A vulnerability in Chainlit versions prior to 2.9.4 allows an authenticated attacker to read arbitrary files on the server by manipulating the path in a project element update request. The attacker can copy the file to their session and then retrieve it using the element identifier.
- CVE-2026-82290Medium
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.
- CVE-2026-45019High
Chainlit versions from 2.4.0rc0 to 2.12.0, when features.mcp.enabled is set to true, expose the POST /mcp endpoint without authentication. An attacker can control the URL and headers, allowing blind outbound requests to internal or external services, including cloud metadata endpoints, with arbitrary Authorization and Cookie headers. This issue is fixed in version 2.12.0.
- CVE-2026-56104High
Chainlit before version 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.
Original NVD description (English source)
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.