CVE-2026-45018

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.

• CWE-78

• https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-001--command-injection-via-mcp-stdio
• https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9
• https://github.com/Chainlit/chainlit/releases/tag/2.12.0
• https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j
• https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j

Published

Aug 25, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45010phpMyFAQ before 4.1.2 contains an improper restriction of ex…9.3
• CVE-2026-45011ApostropheCMS is an open-source Node.js content management s…7.3
• CVE-2026-45012ApostropheCMS is an open-source Node.js content management s…7.6
• CVE-2026-45013ApostropheCMS is an open-source Node.js content management s…8.1
• CVE-2026-45014ApostropheCMS is an open-source Node.js content management s…5.3
• CVE-2026-45017Python Liquid is a Python engine for the Liquid template lan…7.5
• CVE-2026-45019Chainlit is a Python framework for building production-ready…7.2
• CVE-2026-4502IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allo…6.5
• CVE-2026-45021Kuma is a modern Envoy-based service mesh that can run on ev…5.1
• CVE-2026-45022go-git is an extensible git implementation library written i…7.5
• CVE-2026-45023AutoGPT is a workflow automation platform for creating, depl…5.4
• CVE-2026-45025WeGIA is a web manager for charitable institutions. In versi…6.8