Login Request a demo
CH
Product
chainlit
by Chainlit · last CVE Sep 9, 2026
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 1High 4Medium 3Low 0
Severity
All severities8Critical1High4Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add chainlit to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-45018
9.8
1%
Aug 25
Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution
Affected: >= 2.4.0rc0, < 2.12.0
CVE-2026-86099
8.2
1%
Sep 9
Chainlit through 2.12.0 Path Traversal via socket.io sessionId
Affected: through 2.12.0
CVE-2026-56104
8.2
0%
Jun 22
Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration
Affected: before 2.10.1
CVE-2026-22219
7.7
5%
Jan 19
Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element
Affected: before 2.9.4
CVE-2026-45019
7.2
0%
Aug 25
Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access
Affected: >= 2.4.0rc0, < 2.12.0
CVE-2026-22218
6.5
10%
Jan 19
Chainlit < 2.9.4 Arbitrary File Read via /project/element
Affected: before 2.9.4
CVE-2026-82290
5.3
0%
Aug 28
Chainlit Feedback Endpoints Missing Ownership Validation
Affected: through 2.12.0
CVE-2025-68492
4.2
0%
Jan 14
Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability
Affected: prior to 2.8.5
Showing 8