PT-2026-135482
CVE-2026-120492
·
تاريخ النشر
2026-11-02
·
تاريخ التحديث
2026-11-02
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed urls entries because validate mcp url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾