chainlitGHSA-2g59-m95p-pgfq
Chainlit contain a server-side request forgery (SSRF) vulnerability
High7.7CVE-2026-22219 · Published Jan 20, 2026 · updated Jul 7, 2026
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| chainlit PyPI | < 2.9.4 | 2.9.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-918
- Also known as
- CVE-2026-22219, PYSEC-2026-1237
- nvd.nist.gov/vuln/detail/CVE-2026-22219
- github.com/Chainlit/chainlit/commit/ffc3cce648b343b933e10e85ee5805c7e02ab3bf
- github.com/Chainlit/chainlit
- github.com/Chainlit/chainlit/releases/tag/2.9.4
- www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element
- www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover
More chainlit advisories
All chainlit| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 25 | chainlit: server-side request forgery High7.2Aug 25 | High7.2 | 2.12.0 |
| Aug 25 | Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code executionCritical9.8Aug 25 | Critical9.8 | 2.12.0 |
| Jun 22 | Chainlit contains a session hijacking vulnerabilityCritical7.4Jun 22 | Critical7.4 | 2.10.1 |
| Jan 20 | chainlit: arbitrary file readMedium6.5Jan 20 | Medium6.5 | 2.9.4 |
| Jan 14 | Chainlit contains an authorization bypass vulnerabilityLow4.2Jan 14 | Low4.2 | 2.8.5 |