Tracking: CVE-2026-45018
Severity: Critical
Who is affected
Chainlit from 2.4.0rc0 through the listed affected 2.11.1 release, with features.mcp.enabled=true. MCP is disabled by default from 2.7.0, so version alone does not establish exposure.
How the attack works
The stdio configuration endpoint accepts a fullCommand. Checking the executable name does not safely constrain its arguments: an allowed launcher such as npx can receive arguments that invoke a shell or run unintended code. The reported flow can be reached by an unauthenticated client able to establish a session.
Execution occurs as the Chainlit process and may happen before the MCP connection succeeds. A server-start failure does not rule out command execution.
What to do
- Upgrade to 2.12.0 or later and keep MCP disabled where unnecessary.
- Review the executable and argument restrictions together. An unrestricted allowlist configuration should not be mistaken for a security boundary.
- Audit saved stdio commands and unexpected child processes. Assess credentials accessible to the Chainlit service if suspicious execution is found.
Scope and limits
A disabled MCP feature removes this reported configuration path. Confirm the effective setting on each running instance.