AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-w3fx-mc44-mf6j: Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

criticalvulnerability

security

Source: GitHub Advisory DatabaseAugust 25, 2026CVE-2026-45018

Summary

Chainlit versions 2.4.0 through 2.11.x have a critical vulnerability in their MCP (Model Context Protocol) feature that allows unauthenticated attackers to execute arbitrary commands on the server. The vulnerability exists because the `/mcp` endpoint accepts user-controlled commands but only checks the executable name (like `npx`) against an allowlist, not the arguments passed to it, allowing attackers to use `npx -y -c 'ARBITRARY COMMAND'` to run malicious code with the server's privileges.

Solution / Mitigation

Upgrade to Chainlit version 2.12.0 (released 2026-08-25). This version removes the `fullCommand` parameter from client requests entirely; instead, MCP servers are now declared by developers in `.chainlit/config.toml` under `[[features.mcp.servers]]` and selected by name at connection time, so commands never cross from client to server and no sanitization vulnerability exists.