CVE-2026-45018

Name of the Vulnerable Software and Affected Versions Chainlit versions 2.4.0rc0 through 2.11.9

Description Deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the 'POST /mcp' endpoint without authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate mcp command() function in backend/chainlit/mcp.py only verifies the executable name against config.features.mcp.stdio.allowed executables and passes unchecked arguments to StdioServerParameters in backend/chainlit/server.py. Since npx supports the -c argument, an attacker can execute arbitrary shell commands with the privileges of the Chainlit process. If allowed executables is unset, the default value allows every executable.

Recommendations Update to version 2.12.0. As a temporary mitigation, set features.mcp.enabled to false in .chainlit/config.toml or restrict access to the 'POST /mcp' endpoint.