Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element
Vulnerability Description
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.
CVSS Information
N/A
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
Chainlit 代码问题漏洞
Vulnerability Description
Chainlit是chainlit开源的一个大模型对话界面框架。 Chainlit 2.9.4之前版本存在代码问题漏洞，该漏洞源于对/project/element更新流程中URL参数处理不当，可能导致服务器端请求伪造。
CVSS Information
N/A
Vulnerability Type
N/A