{"data":{"id":"7a481ece-5c99-4a1c-917f-ea15e42d9c07","title":"GHSA-w3fx-mc44-mf6j: Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution","summary":"Chainlit versions from 2.4.0rc0 up to but not including 2.12.0 are affected when features.mcp.enabled is set to true in .chainlit/config.toml, tracked as CVE-2026-45018. The POST /mcp endpoint for stdio transport accepts a user-controlled fullCommand string, and validate_mcp_command() checks only the executable name against allowed_executables without restricting its arguments, so an unauthenticated attacker can pass npx -y -c with a payload to run arbitrary shell commands with the privileges of the Chainlit process. Since v2.7.0, MCP is disabled by default.","solution":"Fixed in 2.12.0. The fix removes fullCommand from the client request; stdio MCP servers are declared by the developer in .chainlit/config.toml under [[features.mcp.servers]] and selected by name, and per-server environment variables are set via an env mapping on the server entry. The source's Workarounds section is empty, so no interim workaround is stated.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-w3fx-mc44-mf6j","publishedAt":"2026-08-25T19:19:28.000Z","cveId":"CVE-2026-45018","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["chainlit@>= 2.4.0rc0, <= 2.11.1 (fixed: 2.12.0)"],"affectedPackageNames":["chainlit"],"affectedPackageRefs":["pypi:chainlit"],"affectedVendors":[],"affectedVendorsRaw":["Chainlit"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01086,"epssCheckedAt":"2026-10-12T00:08:14.098Z","kevDateAdded":null,"advisoryAliases":["GHSA-w3fx-mc44-mf6j"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-25T19:19:28.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}