{"action":"Upgrade chainlit to 2.10.1 or later.","affected":[{"fixed":"2.10.1","introduced":"0"}],"component":"chainlit","cve_ids":["CVE-2026-56104"],"ecosystem":"PyPI","epss":0.00417,"exploited":false,"fixed_versions":["2.10.1"],"ghsa_id":"GHSA-c39v-8hrw-h448","id":"tcs_01M5KH9BWYBV4HAZ9H140XGK1C","modified_at":"2026-10-01T17:45:05.547351343Z","published_at":"2026-10-01T16:38:28.448202Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4028","https://nvd.nist.gov/vuln/detail/CVE-2026-56104","https://github.com/Chainlit/chainlit/pull/2857","https://github.com/Chainlit/chainlit/commit/5effb664f1e0af4a4f0a42fe63ea979676039a7f","https://github.com/Chainlit/chainlit","https://github.com/Chainlit/chainlit/releases/tag/2.10.1","https://www.vulncheck.com/advisories/chainlit-session-hijacking-via-websocket-session-restoration","https://pypi.org/project/chainlit","https://github.com/advisories/GHSA-c39v-8hrw-h448"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-4028","url":"https://osv.dev/vulnerability/PYSEC-2026-4028"}],"summary":"Chainlit contains a session hijacking vulnerability"}