Chainlit up to 2.11.x MCP Endpoint backend/chainlit/mcp.py validate_mcp_command fullCommand os command injection

Summaryinfo

A vulnerability identified as critical has been detected in Chainlit up to 2.11.x. The impacted element is the function validate_mcp_command of the file backend/chainlit/mcp.py of the component MCP Endpoint. This manipulation of the argument fullCommand causes os command injection. This vulnerability is registered as CVE-2026-45018. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Chainlit up to 2.11.x. It has been declared as critical. Affected by this vulnerability is the function validate_mcp_command of the file backend/chainlit/mcp.py of the component MCP Endpoint. The manipulation of the argument fullCommand with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-45018 since 05/08/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

Upgrading to version 2.12.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Chainlit

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11

Website

• Product: https://github.com/Chainlit/chainlit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion