CH
Vendor
Chainlit
8
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-86099 | CH chainlit Chainlit | 8.2 | Sep 9 | Chainlit through 2.12.0 Path Traversal via socket.io sessionId |
| CVE-2026-82290 | CH chainlit Chainlit | 5.3 | Aug 28 | Chainlit Feedback Endpoints Missing Ownership Validation |
| CVE-2026-45019 | CH chainlit Chainlit | 7.2 | Aug 25 | Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access |
| CVE-2026-45018 | CH chainlit Chainlit | 9.8 | Aug 25 | Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution |
| CVE-2026-56104 | CH chainlit Chainlit | 8.2 | Jun 22 | Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration |
| CVE-2026-22219 | CH Chainlit Chainlit | 7.7 | Jan 19 | Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element |
| CVE-2026-22218 | CH Chainlit Chainlit | 6.5 | Jan 19 | Chainlit < 2.9.4 Arbitrary File Read via /project/element |
| CVE-2025-68492 | CH Chainlit Chainlit | 4.2 | Jan 14 | Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability |