Command Injection Affecting chainlit package, versions [2.4.0rc0, 2.12.0)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-CHAINLIT-19268250
- published26 Aug 2026
- disclosed25 Aug 2026
- creditqvipin, ladderlogix
Introduced: 25 Aug 2026
NewCVE-2026-45018 (opens in a new tab)How to fix?
Upgrade chainlit to version 2.12.0 or higher.
Overview
chainlit is a Build Conversational AI.
Affected versions of this package are vulnerable to Command Injection through the validate_mcp_command() flow in backend/chainlit/mcp.py and the /mcp stdio connect handler. An attacker can execute arbitrary OS commands on the server by sending a POST /mcp request with a crafted fullCommand such as npx -y -c 'PAYLOAD'. When features.mcp.enabled = true, the injected command runs with the privileges of the Chainlit process before the MCP handshake completes, enabling remote code execution and full host compromise.
Workarounds
- Set
features.mcp.enabled = falsein.chainlit/config.tomlto disable/mcpentirely and block the unauthenticated command-injection path. - Register an authentication callback so
/mcprequires an authenticated session, which removes the unauthenticated attack path.