{"action":"Upgrade chainlit to 2.10.1 or later.","affected":[{"fixed":"2.10.1","introduced":"0"}],"component":"chainlit","cve_ids":["CVE-2026-56104"],"ecosystem":"PyPI","epss":0.00417,"exploited":false,"fixed_versions":["2.10.1"],"ghsa_id":"GHSA-c39v-8hrw-h448","id":"tcs_01M5KFC1PGHGV1X2ME711ZBRZA","modified_at":"2026-10-01T17:56:10.751822436Z","published_at":"2026-06-22T18:34:16Z","references":["https://osv.dev/vulnerability/GHSA-c39v-8hrw-h448","https://nvd.nist.gov/vuln/detail/CVE-2026-56104","https://github.com/Chainlit/chainlit/pull/2857","https://github.com/Chainlit/chainlit/commit/5effb664f1e0af4a4f0a42fe63ea979676039a7f","https://github.com/Chainlit/chainlit","https://github.com/Chainlit/chainlit/releases/tag/2.10.1","https://www.vulncheck.com/advisories/chainlit-session-hijacking-via-websocket-session-restoration"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-c39v-8hrw-h448","url":"https://osv.dev/vulnerability/GHSA-c39v-8hrw-h448"}],"summary":"Chainlit contains a session hijacking vulnerability"}