HIGH7.7PyPI
PYSEC-2026-1237· CVE-2026-22219, GHSA-2g59-m95p-pgfqChainlit contain a server-side request forgery (SSRF) vulnerability
Modified: 7/7/2026
package
PyPI/chainlit
pkg:pypi/chainlit
MEDIUM4.2PyPI
PYSEC-2026-1238· CVE-2025-68492, GHSA-v492-6xx2-p57gChainlit contains an authorization bypass vulnerability
Modified: 7/7/2026
HIGH7.2PyPI
PYSEC-2026-3811· CVE-2026-45019, GHSA-hvfh-5mj3-5f3jChainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Modified: 9/10/2026
CRITICAL9.8PyPI
PYSEC-2026-3812· CVE-2026-45018, GHSA-w3fx-mc44-mf6jChainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
Modified: 9/10/2026
HIGH7.4PyPI
PYSEC-2026-4028· CVE-2026-56104, GHSA-c39v-8hrw-h448Chainlit contains a session hijacking vulnerability
Modified: 10/1/2026
MEDIUM6.5PyPI
PYSEC-2026-598· CVE-2026-22218Modified: 7/2/2026
HIGH7.7PyPI
GHSA-2g59-m95p-pgfq· CVE-2026-22219, PYSEC-2026-1237Chainlit contain a server-side request forgery (SSRF) vulnerability
Modified: 7/7/2026
HIGH7.4PyPI
GHSA-c39v-8hrw-h448· CVE-2026-56104, PYSEC-2026-4028Chainlit contains a session hijacking vulnerability
Modified: 10/1/2026
HIGH7.2PyPI
GHSA-hvfh-5mj3-5f3j· CVE-2026-45019, PYSEC-2026-3811Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Modified: 9/10/2026
MEDIUM4.2PyPI
GHSA-v492-6xx2-p57g· CVE-2025-68492, PYSEC-2026-1238Chainlit contains an authorization bypass vulnerability
Modified: 7/7/2026
CRITICAL9.8PyPI
GHSA-w3fx-mc44-mf6j· CVE-2026-45018, PYSEC-2026-3812Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
Modified: 9/10/2026