DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-45018: CVE-2026-45018: Unauthenticated Remote Code Execution via MCP stdio Transport in Chainlit

#security #cve #cybersecurity

CVE-2026-45018: Unauthenticated Remote Code Execution via MCP stdio Transport in Chainlit

Vulnerability ID: CVE-2026-45018
CVSS Score: 9.8
Published: 2026-08-25

CVE-2026-45018 is a critical command injection vulnerability in Chainlit's Model Context Protocol (MCP) stdio transport backend. By submitting a crafted JSON payload containing dangerous argument options to an unauthenticated HTTP endpoint, a remote attacker can bypass executable validation rules and run arbitrary shell commands with the privileges of the active Python process.

TL;DR

Unauthenticated command injection vulnerability in Chainlit's /mcp endpoint allows remote attackers to execute arbitrary system commands via shell execution arguments inside the stdio transport parameters.

Technical Details

  • CWE ID: CWE-78
  • Attack Vector: Network
  • CVSS Score: 9.8 (Critical)
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed
  • EPSS Score: Not Available
  • Impact: Arbitrary Code Execution

Affected Systems

  • Chainlit Applications
  • chainlit: >= 2.4.0rc0, < 2.12.0 (Fixed in: 2.12.0)

Code Analysis

Commit: 0565fd0

Refactor MCP integration to remove client-side command execution and enforce server-side static configurations

Mitigation Strategies

  • Upgrade Chainlit to 2.12.0 or higher
  • Disable Model Context Protocol by setting features.mcp.enabled = false in config.toml
  • Restrict outbound network egress traffic from application servers

Remediation Steps:

  1. Check current installed package version using pip show chainlit.
  2. If version is within the vulnerability range, append enabled = false inside the [features.mcp] configuration block in .chainlit/config.toml.
  3. Execute package upgrade command pip install -U chainlit>=2.12.0.
  4. Verify service startup behavior and validate that the /mcp path rejects legacy fullCommand arguments.

References

Read the full report for CVE-2026-45018 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)