{"action":"Upgrade chainlit to 2.9.4 or later.","affected":[{"fixed":"2.9.4","introduced":"0"}],"component":"chainlit","cve_ids":["CVE-2026-22219"],"ecosystem":"PyPI","epss":0.05174,"exploited":false,"fixed_versions":["2.9.4"],"ghsa_id":"GHSA-2g59-m95p-pgfq","id":"tcs_01M5KESHF5SS6RTNXC0FRV2WDS","modified_at":"2026-07-07T17:57:22.370684872Z","published_at":"2026-01-20T00:30:28Z","references":["https://osv.dev/vulnerability/GHSA-2g59-m95p-pgfq","https://nvd.nist.gov/vuln/detail/CVE-2026-22219","https://github.com/Chainlit/chainlit/commit/ffc3cce648b343b933e10e85ee5805c7e02ab3bf","https://github.com/Chainlit/chainlit","https://github.com/Chainlit/chainlit/releases/tag/2.9.4","https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element","https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-2g59-m95p-pgfq","url":"https://osv.dev/vulnerability/GHSA-2g59-m95p-pgfq"}],"summary":"Chainlit contain a server-side request forgery (SSRF) vulnerability"}