Chainlit vulnerabilities
Products
- Chainlit 9
Newest
- chainlit Chainlit through 2.12.0 Path Traversal via socket.io sessionId 8.8 High
- chainlit Chainlit Feedback Endpoints Missing Ownership Validation 6.0 Medium
- chainlit Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls 6.3 Medium
- chainlit Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access 7.2 High
- chainlit Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution 9.8 Critical
- chainlit Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration 8.8 High
- chainlit Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element 8.3 High
- chainlit Chainlit < 2.9.4 Arbitrary File Read via /project/element 7.1 High
- chainlit Chainlit contains an authorization bypass vulnerability 2.3 Low