CVE-2026-45018
Received Received - Intake

Remote Code Execution in Chainlit via Unauthenticated MCP Endpoint

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-26
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-45018
EUVD
EUVD-2026-65737

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
chainlit chainlit From 2.4.0rc0 (inc) to 2.11.1 (inc)
chainlit chainlit to 2.12.0 (inc)
chainlit chainlit 2.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Chainlit versions 2.4.0rc0 to 2.12.0. When the MCP feature is enabled without authentication, the POST /mcp endpoint allows attackers to execute arbitrary shell commands via the npx -c argument. The system only validates the executable name but passes unchecked arguments, letting attackers run commands with the Chainlit process privileges.

Detection Guidance

Check if Chainlit is running with features.mcp.enabled set to true in .chainlit/config.toml. Verify if the POST /mcp endpoint is exposed without authentication. Inspect network traffic for suspicious POST requests to /mcp with user-controlled fullCommand parameters.

Impact Analysis

An attacker could gain full control over the Chainlit server, steal sensitive data, modify system files, or perform other malicious actions with the same permissions as the Chainlit process. This could lead to data breaches, service disruption, or unauthorized access to connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using affected Chainlit versions may face compliance violations, legal penalties, and reputational damage due to potential exposure of personal or health data.

Mitigation Strategies

Upgrade Chainlit to version 2.12.0 or later. If upgrading is not possible, disable the MCP feature by setting features.mcp.enabled to false in .chainlit/config.toml. Ensure allowed_executables is explicitly configured to restrict executable access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart