External risk intelligence

Chainlit MCP Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-45018

Chainlit is a framework used to deploy conversational AI applications, which are commonly deployed as public-facing web interfaces. When the specified configuration is enabled, the vulnerable endpoint becomes an externally reachable part of the web application surface.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Chainlit, a framework for building conversational AI applications. When specific features are enabled, an unauthenticated endpoint is exposed, allowing attackers to execute arbitrary shell commands with the privileges of the Chainlit process by sending specially crafted requests. This could lead to a complete compromise of the affected system.

Unauthenticated commands can run on the server.
Critical vulnerability in conversational AI framework.
Verify if this AI framework is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a publicly exposed endpoint on a Chainlit application. This endpoint, when enabled with certain configurations, does not check for authentication and allows the attacker to provide a command that is then executed by the server. This can happen if the application allows any executable to run and doesn't restrict what arguments can be passed.

No authentication required for endpoint.
User-controlled command is executed.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary shell commands on the server hosting the Chainlit application, provided specific configurations are enabled. This could lead to the compromise of the server and any data it can access.

Server-side code execution.
Unauthenticated network access.
Arbitrary command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for deploying and managing Chainlit applications, including application owners, platform teams, and security teams, should address this vulnerability. The immediate first step is to inventory all Chainlit deployments, confirm if the `features.mcp.enabled` configuration is active, and assess exposure and criticality of affected instances before planning remediation.

Identify Chainlit deployments and assess exposure.
Confirm accountable owner and risk profile.
Plan remediation based on application criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chainlit?

Chainlit is a specialized Python framework designed for developers to create and deploy conversational AI interfaces. It serves as the backend engine that manages the interaction flow between users and AI models, commonly utilized to build custom chat applications that require a production-ready web interface.

How does CVE-2026-45018 create a security risk?

This vulnerability is classified as Improper Neutralization of Special Elements used in an OS Command (CWE-78). It occurs because the framework fails to properly sanitize user-provided inputs sent to its Model Context Protocol (MCP) endpoint. This allows an unauthorized person to inject malicious shell commands that the server inadvertently executes.

Do I need specific settings enabled for this bug to trigger?

Yes. The vulnerability only triggers if the features.mcp.enabled setting is active in your configuration file. If this feature is disabled, or if you have strictly defined and limited the allowed executables in your configuration, the specific path for arbitrary command execution is not accessible.

How does Halo Surface Signal assess this risk?

Halo Surface Signal flags this as a likely concern because Chainlit applications are often designed as public-facing web services. If your deployment is reachable over the internet with the MCP feature enabled, an attacker can reach the vulnerable endpoint directly without needing prior authentication or internal network access.

Is it time to update my Chainlit installation?

Yes. The immediate priority is to verify if your current version is between 2.4.0rc0 and 2.12.0. If you are using an affected version, upgrade to 2.12.0 or later, which includes the necessary patches to properly validate commands and secure the MCP endpoint.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.