CVE-2026-45018
2 advisories.
PyPI/chainlit CVE-2026-45018: critical 9.8, EPSS 1.09%
Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
Action: Upgrade chainlit to 2.12.0 or later.
pip install chainlit==2.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.4.0rc0 | 2.12.0 | - |
Fixed versions
| 2.12.0 |
Sources
- osv: GHSA-w3fx-mc44-mf6j
- https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j
- https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9
- https://github.com/Chainlit/chainlit
- https://github.com/Chainlit/chainlit/releases/tag/2.12.0
CVE-2026-45018 · published · modified · JSON
PyPI/chainlit CVE-2026-45018: critical 9.8, EPSS 1.09%
Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
Action: Upgrade chainlit to 2.12.0 or later.
pip install chainlit==2.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.4.0rc0 | 2.12.0 | - |
Fixed versions
| 2.12.0 |
Sources
- osv: PYSEC-2026-3812
- https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j
- https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9
- https://github.com/Chainlit/chainlit
- https://github.com/Chainlit/chainlit/releases/tag/2.12.0
- https://pypi.org/project/chainlit
- https://github.com/advisories/GHSA-w3fx-mc44-mf6j
- https://nvd.nist.gov/vuln/detail/CVE-2026-45018
CVE-2026-45018 · published · modified · JSON