Skip to content
OpenAdvisories

Package · PyPI

chainlit

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-120492

    Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls

    Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;…

    Chainlit Chainlit chainlit PyPI
  • Medium 4.2
    CVE-2025-68492

    Chainlit contains an authorization bypass vulnerability

    Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

    Chainlit Chainlit chainlit PyPI