Description
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.
Published: 2026-08-25
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Chainlit, a Python framework for building conversational AI, has a command injection flaw in the MCP stdio transport. The vulnerability occurs when the features.mcp.enabled flag is true in .chainlit/config.toml and the POST /mcp endpoint is exposed without authentication. The backend checks only the executable name against a whitelist; if this list is unset or contains npx, an attacker can provide an arbitrary shell command that runs with the privileges of the Chainlit process.

Affected Systems

This issue affects Chainlit deployments on versions from 2.4.0rc0 up to but not including 2.12.0 when MCP is enabled. Configurations that leave features.mcp.stdio.allowed_executables unset or that allow the npx utility can be compromised. The vulnerability is fixed in version 2.12.0.

Risk and Exploitability

The CVSS score indicates critical severity, and the flaw does not require authentication or elevated privileges beyond those that the Chainlit process already has. The flaw can be exploited by sending a crafted POST request to /mcp with a fullCommand string; the attack path is therefore remote and unauthenticated. EPSS is not available, and the vulnerability is not in the CISA KEV catalog, but the combination of public access and ability to execute arbitrary commands makes it immediately exploitable.

Generated by OpenCVE AI on August 25, 2026 at 22:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chainlit to version 2.12.0 or later to apply the patch that removes the unauthenticated endpoint and validates command arguments.
  • If an upgrade is not possible, disable the MCP feature by setting features.mcp.enabled to false in the .chainlit/config.toml configuration to block the vulnerable endpoint.
  • If disabling MCP is unacceptable, restrict the whitelist of allowed executables by setting features.mcp.stdio.allowed_executables to a list of trusted binaries; this prevents arbitrary command execution.

Generated by OpenCVE AI on August 25, 2026 at 22:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-w3fx-mc44-mf6j Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
History

Tue, 25 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Chainlit
Chainlit chainlit
Vendors & Products Chainlit
Chainlit chainlit

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.
Title Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Chainlit Chainlit
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T19:33:30.993Z

Reserved: 2026-05-08T16:58:28.895Z

Link: CVE-2026-45018

cve-icon Vulnrichment

Updated: 2026-08-25T19:33:23.012Z

cve-icon NVD

Status : Received

Published: 2026-08-25T20:16:55.720

Modified: 2026-08-25T20:16:55.720

Link: CVE-2026-45018

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T22:30:17Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')