p PatchFirst

CVE-2026-45018

CVE-2026-45018 · Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.

CVSS 9.8 · Crítica · EPSS 1,1% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • chainlit

    Versiones
    • >= 2.4.0rc0, < 2.12.0: Afectada

    Sin corrección publicada

  • chainlit PyPI

    Versiones
    • 2.10.0
    • 2.10.1
    • 2.11.0
    • 2.11.1
    • 2.4.0
    • 2.4.0rc0
    • 2.4.1
    • 2.4.2
    • 2.4.201
    • 2.4.3
    • 2.4.301
    • 2.4.302
    • 2.4.400
    • 2.5.5
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.6.4
    • 2.6.5
    • 2.6.6
    • 2.6.7
    • 2.6.8
    • 2.6.9
    • 2.7.0
    • 2.7.1
    • 2.7.1.1
    • 2.7.2
    • 2.8.0
    • 2.8.1
    • 2.8.2
    • 2.8.3
    • 2.8.4
    • 2.8.5
    • 2.9.0
    • 2.9.1
    • 2.9.2
    • 2.9.3
    • 2.9.4
    • 2.9.5
    • 2.9.6
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 2.4.0rc0, < 2.12.0

    Actualiza a 2.12.0

Fuentes originales

Comprueba tu servidor →