Skip to content
OpenAdvisories

Package · PyPI

chainlit

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-56104

    Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration

    Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Att…

    Chainlit Chainlit chainlit PyPI
  • High 8.3
    CVE-2026-22219

    Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element

    Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Eleme…

    Chainlit Chainlit chainlit PyPI
  • High 7.1
    CVE-2026-22218

    Chainlit < 2.9.4 Arbitrary File Read via /project/element

    Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the att…

    Chainlit Chainlit chainlit PyPI