Description
Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Chainlit | Chainlit | 2.12.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | chainlit | >= 2.4.0rc0, < 2.12.0 | 2.12.0 | GHSA-hvfh-5mj3-5f3j |
References
- GitHub Security Advisory (GHSA-hvfh-5mj3-5f3j) vendor-advisory
- https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L90-L177 technical-description
- https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L199-L208 technical-description
- VulnCheck Advisory: Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls third-party-advisory