漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element
Vulnerability Description
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.
CVSS Information
N/A
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
Chainlit 代码问题漏洞
Vulnerability Description
Chainlit是chainlit开源的一个大模型对话界面框架。 Chainlit 2.9.4之前版本存在代码问题漏洞，该漏洞源于对/project/element更新流程中URL参数处理不当，可能导致服务器端请求伪造。
CVSS Information
N/A
Vulnerability Type
N/A