CriticalVulnerability

GHSA-w3fx-mc44-mf6j: Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-45018GHSA-w3fx-mc44-mf6j
Published: August 25, 2026
Record updated: October 9, 2026

Affected: chainlit >= 2.4.0rc0, <= 2.11.1
Fixed in: 2.12.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 1.1%

Summary

Chainlit versions from 2.4.0rc0 up to but not including 2.12.0 are affected when features.mcp.enabled is set to true in .chainlit/config.toml, tracked as CVE-2026-45018. The POST /mcp endpoint for stdio transport accepts a user-controlled fullCommand string, and validate_mcp_command() checks only the executable name against allowed_executables without restricting its arguments, so an unauthenticated attacker can pass npx -y -c with a payload to run arbitrary shell commands with the privileges of the Chainlit process. Since v2.7.0, MCP is disabled by default.

Mitigation

Fixed in 2.12.0. The fix removes fullCommand from the client request; stdio MCP servers are declared by the developer in .chainlit/config.toml under [[features.mcp.servers]] and selected by name, and per-server environment variables are set via an env mapping on the server entry. The source's Workarounds section is empty, so no interim workaround is stated.

Details

Scores and exploitation

Patch available: Yes
EPSS: 1.1%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 11, 2026.
Disclosure date: August 25, 2026

Affected

Packages: chainlit@>= 2.4.0rc0, <= 2.11.1 (fixed: 2.12.0)

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: Plugin
Impact: Confidentiality,
Integrity,
Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-w3fx-mc44-mf6j

First tracked: August 25, 2026 at 08:01 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

chainlitPyPILLM dependency since 2025-03-09 · 2 tracked dependents

Topics

Model Context Protocol

Summary

Mitigation

Affected packages in the Exposure Registry

Topics

Related items