PyPI/chainlit CVE-2026-22219: high 7.7, EPSS 5.17%

Chainlit contain a server-side request forgery (SSRF) vulnerability

Action: Upgrade chainlit to 2.9.4 or later.

pip install chainlit==2.9.4

Affected

Fixed versions

Sources

• osv: GHSA-2g59-m95p-pgfq
• https://nvd.nist.gov/vuln/detail/CVE-2026-22219
• https://github.com/Chainlit/chainlit/commit/ffc3cce648b343b933e10e85ee5805c7e02ab3bf
• https://github.com/Chainlit/chainlit
• https://github.com/Chainlit/chainlit/releases/tag/2.9.4
• https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element
• https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover

CVE-2026-22219 · published 2026-01-20T00:30:28Z · modified 2026-07-07T17:57:22.370684872Z · JSON