Ladderlogix

**Name of the Vulnerable Software and Affected Versions** Chainlit versions 2.4.0rc0 through 2.11.9 **Description** Deployments with `features.mcp.enabled` set to true in `.chainlit/config.toml` expose the 'POST /mcp' endpoint without authentication. For stdio transport, the endpoint accepts a user-controlled `fullCommand` string. The `validate mcp command()` function in `backend/chainlit/mcp.py` only verifies the executable name against `config.features.mcp.stdio.allowed executables` and passes unchecked arguments to `StdioServerParameters` in `backend/chainlit/server.py`. Since `npx` supports the `-c` argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If `allowed executables` is unset, the default value allows every executable. **Recommendations** Update to version 2.12.0. As a temporary mitigation, set `features.mcp.enabled` to false in `.chainlit/config.toml` or restrict access to the 'POST /mcp' endpoint.

**Name of the Vulnerable Software and Affected Versions** Chainlit versions 2.4.0rc0 through 2.11.x **Description** Chainlit deployments with `features.mcp.enabled` set to true in `.chainlit/config.toml` expose the 'POST /mcp' endpoint without authentication. The `ConnectSseMCPRequest` and `ConnectStreamableHttpMCPRequest` in `backend/chainlit/types.py` accept a user-controlled `url` and optional `headers` dictionary without scheme validation, private-address filtering, or an allowlist. The `connect mcp()` handler in `backend/chainlit/server.py` passes these values to `sse client()` or `streamablehttp client()`, enabling the server to make blind outbound requests to arbitrary internal or external services, including cloud metadata endpoints, using attacker-controlled `Authorization` and `Cookie` headers. This allows attackers to issue state-changing authenticated requests, discover internal services, scan ports, and probe metadata endpoints. **Recommendations** Update to version 2.12.0. As a temporary workaround, set `features.mcp.enabled` to false in `.chainlit/config.toml` to disable the vulnerable functionality.