Skip to content
OpenAdvisories

Vendor

Chainlit

9 known vulnerabilities.

Products

Chainlit 9
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-120492

    Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls

    Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;…

    Chainlit Chainlit chainlit PyPI
  • Medium 5.3
    CVE-2026-82290

    Chainlit Feedback Endpoints Missing Ownership Validation

    Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model ev…

    Chainlit Chainlit
  • Medium 4.2
    CVE-2025-68492

    Chainlit contains an authorization bypass vulnerability

    Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

    Chainlit Chainlit chainlit PyPI