PyPI/chainlit CVE-2026-45018: critical 9.8, EPSS 1.09%

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Action: Upgrade chainlit to 2.12.0 or later.

pip install chainlit==2.12.0

Affected

Fixed versions

Sources

• osv: GHSA-w3fx-mc44-mf6j
• https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j
• https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9
• https://github.com/Chainlit/chainlit
• https://github.com/Chainlit/chainlit/releases/tag/2.12.0

CVE-2026-45018 · published 2026-08-25T19:19:28Z · modified 2026-09-10T12:26:01.565580392Z · JSON