{"data":{"ecosystem":"pypi","name":"chainlit","url":"https://aisecwatch.com/packages/pypi/chainlit","latestVersion":"2.12.0","firstReleaseAt":"2023-03-31T14:27:57.473Z","repository":"https://github.com/Chainlit/chainlit","llm":{"exposure":"direct","depth":0,"integratedAt":"2025-03-09T21:49:24.448Z","integratedVersion":"2.4.0rc0","sdks":["huggingface","langchain","llama-index","mcp","openai","semantic-kernel"],"path":[]},"authority":{"profile":["filesystem","http","mcp_tools"],"fromDependencies":["pypi:aiofiles","pypi:httpx","pypi:mcp"]},"dependencies":[{"ecosystem":"pypi","name":"langchain","versionSpec":">=1.0.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"llama-index","versionSpec":"<1.0.0,>=0.13.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"mcp","versionSpec":"<2.0.0,>=1.28.1","scope":"runtime"},{"ecosystem":"pypi","name":"openai","versionSpec":"<3.0.0,>=2.0.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"semantic-kernel","versionSpec":"<2.0.0,>=1.24.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"transformers","versionSpec":"<6.0,>=5.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"aiofiles","versionSpec":">=23.1.0","scope":"runtime"},{"ecosystem":"pypi","name":"aiosqlite","versionSpec":"<1.0.0,>=0.20.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"asyncer","versionSpec":"<0.1.0,>=0.0.8","scope":"runtime"},{"ecosystem":"pypi","name":"asyncpg","versionSpec":"<1.0.0,>=0.30.0","scope":"extra:custom-data"},{"ecosystem":"pypi","name":"azure-identity","versionSpec":"<2.0.0,>=1.14.1","scope":"extra:custom-data"},{"ecosystem":"pypi","name":"azure-storage-blob","versionSpec":"<13.0.0,>=12.24.0","scope":"extra:custom-data"},{"ecosystem":"pypi","name":"azure-storage-file-datalake","versionSpec":"<13.0.0,>=12.14.0","scope":"extra:custom-data"},{"ecosystem":"pypi","name":"botbuilder-core","versionSpec":"<5.0.0,>=4.15.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"boto3","versionSpec":"<2.0.0,>=1.34.73","scope":"extra:custom-data"},{"ecosystem":"pypi","name":"click","versionSpec":"<9.0.0,>=8.1.3","scope":"runtime"},{"ecosystem":"pypi","name":"dataclasses-json","versionSpec":"<0.7.0,>=0.6.7","scope":"runtime"},{"ecosystem":"pypi","name":"discord","versionSpec":"<3.0.0,>=2.3.2","scope":"extra:tests"},{"ecosystem":"pypi","name":"fastapi","versionSpec":">=0.116.1","scope":"runtime"},{"ecosystem":"pypi","name":"filetype","versionSpec":"<2.0.0,>=1.2.0","scope":"runtime"},{"ecosystem":"pypi","name":"google-cloud-storage","versionSpec":"<4.0.0,>=2.19.0","scope":"extra:custom-data"},{"ecosystem":"pypi","name":"httpx","versionSpec":">=0.23.0","scope":"runtime"},{"ecosystem":"pypi","name":"lazify","versionSpec":"<0.5.0,>=0.4.0","scope":"runtime"},{"ecosystem":"pypi","name":"literalai","versionSpec":"==0.1.201","scope":"runtime"},{"ecosystem":"pypi","name":"matplotlib","versionSpec":"<4.0.0,>=3.7.1","scope":"extra:tests"},{"ecosystem":"pypi","name":"moto","versionSpec":"<6.0.0,>=5.0.14","scope":"extra:tests"},{"ecosystem":"pypi","name":"mypy","versionSpec":"<2.0.0,>=1.13","scope":"extra:mypy"},{"ecosystem":"pypi","name":"mypy-boto3-dynamodb","versionSpec":"<2.0.0,>=1.34.113","scope":"extra:mypy"},{"ecosystem":"pypi","name":"nest-asyncio","versionSpec":"<2.0.0,>=1.6.0","scope":"runtime"},{"ecosystem":"pypi","name":"packaging","versionSpec":">=23.1","scope":"runtime"},{"ecosystem":"pypi","name":"pandas","versionSpec":"<4.0.0,>=2.2.2","scope":"extra:tests"},{"ecosystem":"pypi","name":"pandas-stubs","versionSpec":"<4.0.0,>=2.2.2","scope":"extra:mypy"},{"ecosystem":"pypi","name":"plotly","versionSpec":"<7.0.0,>=5.3.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"polars","versionSpec":"<2.0.0,>=1.0.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"pydantic","versionSpec":"<3,>=2.11.0","scope":"runtime"},{"ecosystem":"pypi","name":"pydantic-settings","versionSpec":">=2.14.2","scope":"runtime"},{"ecosystem":"pypi","name":"pyjwt","versionSpec":"<3.0.0,>=2.13.0","scope":"runtime"},{"ecosystem":"pypi","name":"pytest","versionSpec":"<10.0.0,>=8.3.2","scope":"extra:tests"},{"ecosystem":"pypi","name":"pytest-asyncio","versionSpec":"<2.0.0,>=1.0.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"pytest-cov","versionSpec":"<7.0.0,>=6.0.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"python-dotenv","versionSpec":"<2.0.0,>=1.0.0","scope":"runtime"},{"ecosystem":"pypi","name":"python-multipart","versionSpec":"<1.0.0,>=0.0.30","scope":"runtime"},{"ecosystem":"pypi","name":"python-socketio","versionSpec":"<6.0.0,>=5.11.0","scope":"runtime"},{"ecosystem":"pypi","name":"slack-bolt","versionSpec":"<2.0.0,>=1.18.1","scope":"extra:tests"},{"ecosystem":"pypi","name":"sqlalchemy","versionSpec":"<3.0.0,>=2.0.28","scope":"extra:custom-data"},{"ecosystem":"pypi","name":"starlette","versionSpec":">=0.47.2","scope":"runtime"},{"ecosystem":"pypi","name":"syncer","versionSpec":"<3.0.0,>=2.0.3","scope":"runtime"},{"ecosystem":"pypi","name":"tenacity","versionSpec":"<10.0.0,>=9.0.0","scope":"extra:tests"},{"ecosystem":"pypi","name":"tomli","versionSpec":"<3.0.0,>=2.0.1","scope":"runtime"},{"ecosystem":"pypi","name":"types-aiofiles","versionSpec":"<26.0.0,>=23.1.0.5","scope":"extra:mypy"},{"ecosystem":"pypi","name":"types-requests","versionSpec":"<3.0.0,>=2.31.0.2","scope":"extra:mypy"},{"ecosystem":"pypi","name":"uvicorn","versionSpec":">=0.35.0","scope":"runtime"},{"ecosystem":"pypi","name":"watchfiles","versionSpec":"<2.0.0,>=1.1.1","scope":"runtime"}],"advisories":[{"id":"162d8574-2040-4cd6-a62a-c66b1d3b3ba2","url":"https://aisecwatch.com/issues/162d8574-2040-4cd6-a62a-c66b1d3b3ba2","cveId":"CVE-2026-45019","title":"GHSA-hvfh-5mj3-5f3j: Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access","headline":null,"severity":"high","publishedAt":"2026-08-25T19:21:40.000Z","affected":["chainlit@>= 2.4.0rc0, <= 2.11.1 (fixed: 2.12.0)"],"epssScore":0.00434},{"id":"7a481ece-5c99-4a1c-917f-ea15e42d9c07","url":"https://aisecwatch.com/issues/7a481ece-5c99-4a1c-917f-ea15e42d9c07","cveId":"CVE-2026-45018","title":"GHSA-w3fx-mc44-mf6j: Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution","headline":null,"severity":"critical","publishedAt":"2026-08-25T19:19:28.000Z","affected":["chainlit@>= 2.4.0rc0, <= 2.11.1 (fixed: 2.12.0)"],"epssScore":0.01086}],"checkedAt":"2026-10-09T21:57:30.110Z"},"meta":{"advisoryMatching":"by package name; advisory records do not state an ecosystem"}}