PyPI/chainlit CVE-2026-45019: high 7.2, EPSS 0.43%
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Action: Upgrade chainlit to 2.12.0 or later.
pip install chainlit==2.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.4.0rc0 | 2.12.0 | - |
Fixed versions
| 2.12.0 |
Sources
- osv: GHSA-hvfh-5mj3-5f3j
- https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j
- https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9
- https://github.com/Chainlit/chainlit
- https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-002--ssrf-via-mcp-streamable-http--sse
- https://github.com/Chainlit/chainlit/releases/tag/2.12.0
CVE-2026-45019 · published · modified · JSON