https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 19:11:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-45018 <p><strong>Affected:</strong> chainlit</p> <p>Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.</p> <p><strong>Affected:</strong> chainlit</p> <p>Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against config.features.mcp.stdio.allowed_executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Because npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed_executables is unset, its None default is treated as allowing every executable. This issue is fixed in version 2.12.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-45018 https://vulnerability.circl.lu/vuln/pysec-2026-3812 <p><strong>Affected:</strong> PyPI: chainlit</p> <p>### Am I affected?</p> <p>Only if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. **MCP has been disabled by default since v2.7.0**, so most Chainlit deployments are not affected. No authentication is required: `/mcp` is reachable by any client that can open a session.</p> <p>### Summary</p> <p>When MCP is enabled (`features.mcp.enabled = true`), the `POST /mcp` endpoint for `stdio` transport accepts a user-controlled `fullCommand` string. The `validate_mcp_command()` function checks the executable name against a configurable allowlist but does not inspect or restrict the arguments. An attacker can pass `npx -y -c &#39;ARBITRARY COMMAND&#39;` to execute arbitrary shell commands on the server with the privileges of the Chainlit process.</p> <p>### Affected / patched versions</p> <p>| | | |---|---| | CVE | CVE-2026-45018 | | Affected | `&gt;=2.4.0rc0, &lt;2.12.0` with `features.mcp.enabled = true` (introduced in PR #1977, the change that added MCP support) | | Patched | **2.12.0** (releasing 2026-08-25) |</p> <p>### Details</p> <p>`validate_mcp_command()` in `backend/chainlit/mcp.py` uses `shlex.split()` to parse the command string and validates only the executable name (e.g., `npx`, `uvx`) against `config.features.mcp.stdio.allowed_executables`. Arguments are returned unchecked and passed directly to `StdioServerParameters`, which spawns a subprocess.</p> <p>Since `npx` supports `-c` for arbitrary shell execution, `npx -y -c &#39;PAYLOAD&#39;` passes the allowlist check while running whatever the attacker specifi…</p> <p><strong>Affected:</strong> PyPI: chainlit</p> <p>### Am I affected?</p> <p>Only if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. **MCP has been disabled by default since v2.7.0**, so most Chainlit deployments are not affected. No authentication is required: `/mcp` is reachable by any client that can open a session.</p> <p>### Summary</p> <p>When MCP is enabled (`features.mcp.enabled = true`), the `POST /mcp` endpoint for `stdio` transport accepts a user-controlled `fullCommand` string. The `validate_mcp_command()` function checks the executable name against a configurable allowlist but does not inspect or restrict the arguments. An attacker can pass `npx -y -c &#39;ARBITRARY COMMAND&#39;` to execute arbitrary shell commands on the server with the privileges of the Chainlit process.</p> <p>### Affected / patched versions</p> <p>| | | |---|---| | CVE | CVE-2026-45018 | | Affected | `&gt;=2.4.0rc0, &lt;2.12.0` with `features.mcp.enabled = true` (introduced in PR #1977, the change that added MCP support) | | Patched | **2.12.0** (releasing 2026-08-25) |</p> <p>### Details</p> <p>`validate_mcp_command()` in `backend/chainlit/mcp.py` uses `shlex.split()` to parse the command string and validates only the executable name (e.g., `npx`, `uvx`) against `config.features.mcp.stdio.allowed_executables`. Arguments are returned unchecked and passed directly to `StdioServerParameters`, which spawns a subprocess.</p> <p>Since `npx` supports `-c` for arbitrary shell execution, `npx -y -c &#39;PAYLOAD&#39;` passes the allowlist check while running whatever the attacker specifi…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3812