chainlit vulnerabilities | LiveThreat CVE Feed

Product

chainlit

by Chainlit · last CVE Sep 9, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 1High 4Medium 3Low 0

Severity

Exploitation

Watch

Add chainlit to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-86099	8.2	1%	Sep 9	Chainlit through 2.12.0 Path Traversal via socket.io sessionId Affected: through 2.12.0
CVE-2026-56104	8.2	0%	Jun 22	Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration Affected: before 2.10.1
CVE-2026-22219	7.7	5%	Jan 19	Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element Affected: before 2.9.4
CVE-2026-45019	7.2	0%	Aug 25	Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access Affected: >= 2.4.0rc0, < 2.12.0