Chainlit CVE-2026-22219

Exploitation requires that Chainlit is deployed with the SQLAlchemy data layer backend enabled for persistence (the vulnerable outbound-fetch code lives in the SQLAlchemy element-creation logic) and that the attacker holds an authenticated, low-privilege account (CVSS PR:L) able to create or update an Element through the /project/element flow. The concrete attacker-controlled input is the url value on an Element, which the server fetches via HTTP GET. Limiting factors: it is NOT exploitable against default deployments that do not enable the SQLAlchemy data layer, and it is NOT unauthenticated - a valid session is needed. Impact is maximized when the server has network reachability to sensitive internal services or a cloud metadata endpoint; environments with strict egress filtering or IMDSv2 enforcement meaningfully reduce the achievable impact.

The signals are mixed and should be read together. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, base 8.3) indicates a network-reachable, low-complexity attack requiring only low privileges (an authenticated app user) with high confidentiality impact and a subsequent-system confidentiality impact (SC:H), consistent with reaching internal/metadata endpoints. Publicly available exploit code raises practical risk, yet EPSS is very low (0.04%, 11th percentile) and the vulnerability is NOT in CISA KEV, so there is no evidence of active or widespread exploitation - the low EPSS despite a public POC suggests limited real-world targeting rather than mass scanning, plausibly because exploitation depends on a non-default configuration. Net: this is a genuine, credible priority for organizations that run Chainlit with the SQLAlchemy data layer and expose it to semi-trusted users (especially in cloud environments with reachable metadata services), but a lower priority for deployments not using that backend. Note the requirement of PR:L means it is authenticated, not an unauthenticated internet-wide risk; verify your data-layer configuration before triaging severity.

An attacker with a valid low-privilege account on a Chainlit app (deployed with the SQLAlchemy data layer) creates or updates an Element whose url points at http://169.254.169.254/latest/meta-data/iam/security-credentials/. The Chainlit server issues an outbound GET to that URL and stores the returned cloud IAM credentials via the storage provider, where the attacker retrieves them - potentially enabling cloud account takeover. Public exploit code for this class of attack is available per the Zafran 'ChainLeak' writeup.