Chainlit 2.12.0 contains a vulnerable URL validation routine that fails to reject semicolon characters in the path. Because the validation logic does not treat the ‘;’ character as a delimiter, an attacker can craft URLs that include ‘..;’ segments. Submitting such URLs to the /mcp endpoint bypasses the path‑scoped MCP enabled_urls entries and causes the application to issue HTTP requests to locations outside the operator's granted origins. The effect is a server‑side request forgery that can be used to access internal services, read sensitive data, or potentially pivot to further attacks inside the network.

The affected product is Chainlit 2.12.0. This is the only version listed in the advisory.

The CVSS score of 6.3 places this issue in the moderate severity bucket. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation at the time of this analysis. The attack can be executed by any unauthenticated user who can send requests to the /mcp endpoint, making the attack vector Internet‑based. Because the flaw allows arbitrary path traversal, the risk to confidentiality and availability of internal resources is significant, but it does not directly elevate to remote code execution. The vulnerability is exploitable under normal operating conditions and does not require elevated privileges on the host running Chainlit.