CVE-2026-45019
2 advisories.
PyPI/chainlit CVE-2026-45019: high 7.2
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Action: Upgrade chainlit to 2.12.0 or later.
pip install chainlit==2.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.4.0rc0 | 2.12.0 | - |
Fixed versions
| 2.12.0 |
Sources
- osv: GHSA-hvfh-5mj3-5f3j
- https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j
- https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9
- https://github.com/Chainlit/chainlit
- https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-002--ssrf-via-mcp-streamable-http--sse
- https://github.com/Chainlit/chainlit/releases/tag/2.12.0
CVE-2026-45019 · published · modified · JSON
PyPI/chainlit CVE-2026-45019: high 7.2
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Action: Upgrade chainlit to 2.12.0 or later.
pip install chainlit==2.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.4.0rc0 | 2.12.0 | - |
Fixed versions
| 2.12.0 |
Sources
- osv: PYSEC-2026-3811
- https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j
- https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9
- https://github.com/Chainlit/chainlit
- https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-002--ssrf-via-mcp-streamable-http--sse
- https://github.com/Chainlit/chainlit/releases/tag/2.12.0
- https://pypi.org/project/chainlit
- https://github.com/advisories/GHSA-hvfh-5mj3-5f3j
- https://nvd.nist.gov/vuln/detail/CVE-2026-45019
CVE-2026-45019 · published · modified · JSON