Chainlit — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in Chainlit, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-120492	Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls CWE-918	5.4	Medium	2026-11-02
CVE-2026-86099	Chainlit through 2.12.0 Path Traversal via socket.io sessionId CWE-22	8.2	High	2026-09-09
CVE-2026-82290	Chainlit Feedback Endpoints Missing Ownership Validation CWE-639	5.3	Medium	2026-08-28
CVE-2026-45019	Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access CWE-918	7.2	High	2026-08-25
CVE-2026-45018	Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution CWE-78	9.8	Critical	2026-08-25
CVE-2026-56104	Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration CWE-862	8.2	High	2026-06-22
CVE-2026-22219	Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element CWE-918	8.3	High	2026-01-19
CVE-2026-22218	Chainlit < 2.9.4 Arbitrary File Read via /project/element CWE-22	6.5^AI	Medium ^AI	2026-01-19
CVE-2025-68492	Chainlit 安全漏洞 CWE-639	4.3^AI	Medium ^AI	2026-01-14

All 9 known CVE vulnerabilities affecting Chainlit with full Chinese analysis, references, and POCs where available.