Which versions of Chainlit are affected by CVE-2026-22219?

Chainlit versions before 2.9.4 contain a server-side request forgery vulnerability in the /project/element update flow that allows authenticated users to coerce the server into fetching…. A patch is available.

Is there a public PoC exploit available for CVE-2026-22219?

Yes, a public proof-of-concept exploit is available for CVE-2026-22219. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-22219?

Within 24 hours, identify all Chainlit deployments and catalog those running versions prior to 2.9.4, especially those configured with SQLAlchemy backends. Within 7 days, apply vendor-released patch Chainlit 2.9.4 or later to all affected instances according to your change management procedures. Within 30 days, verify patch deployment across all systems through version verification or deployment logs, and review application logs for suspicious /project/element update requests to detect potential exploitation attempts.

Chainlit CVE-2026-22219

Q: What is the CVSS score of CVE-2026-22219?

CVE-2026-22219 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-01-20 disclosure@vulncheck.com

GHSA-2g59-m95p-pgfq

SSRF Chainlit

8.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-reachable and low-complexity but needs an authenticated user (PR:L); SSRF reaching internal/metadata services crosses a trust boundary (S:C) with confidentiality-only impact (C:H, I/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 17:08 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 14, 2026 - 17:06 vuln.today

Analysis Updated

Jul 14, 2026 - 17:06 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 16:22 NVD

7.7 (HIGH) 8.3 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 02, 2026 - 20:56 vuln.today

Public exploit code

CVE Published

Jan 20, 2026 - 00:15 nvd

HIGH 7.7

DescriptionCVE.org

Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.

AnalysisAI

Server-side request forgery in Chainlit before 2.9.4 lets an authenticated user coerce the server into fetching an attacker-supplied URL, exposing internal network services and cloud metadata endpoints. The flaw lives in the /project/element update flow specifically when Chainlit is deployed with the SQLAlchemy data layer backend, whose element-creation logic issues an outbound HTTP GET against a user-controlled url field and persists the response through the configured storage provider. Publicly available exploit code exists (documented in Zafran's 'ChainLeak' research), though the flaw is not listed in CISA KEV and its EPSS probability is low at 0.04%.

Technical ContextAI

Chainlit is an open-source Python framework for building conversational and LLM/agent chat applications, offering an optional persistence layer to store threads, steps, and Elements (file/media attachments). When operators enable the SQLAlchemy data layer, the element-creation code path dereferences a client-supplied url attribute on an Element and performs a server-originated HTTP GET to retrieve its contents before saving them via the storage provider. This is a textbook CWE-918 (Server-Side Request Forgery): the server trusts a user-supplied URL as a fetch target without validating scheme, host, or destination, so requests to RFC1918 addresses, localhost, or cloud metadata services (e.g. 169.254.169.254) are honored. The single affected package is cpe:2.3:a:chainlit:chainlit, with the vulnerable behavior gated on the SQLAlchemy backend configuration rather than being present in all deployments.

RemediationAI

Vendor-released patch: 2.9.4 - upgrade Chainlit to 2.9.4 or later, which adds sanitization for custom thread element updates (PR #2737). Note the 2.9.4 upgrade includes a breaking persistence change: if you use persistence you must run the migration ALTER TABLE steps ADD COLUMN IF NOT EXISTS modes JSONB; before or during rollout, so schedule a maintenance window. If you cannot patch immediately, reduce exposure by restricting who can authenticate to the Chainlit application (the attack requires an authenticated client), and place the server behind egress controls: block outbound requests from the Chainlit host to internal RFC1918 ranges, localhost, and especially the cloud metadata endpoint 169.254.169.254 (on AWS, enforce IMDSv2 to require a session token) - the trade-off is that legitimate server-side fetches to those ranges will also break. Where feasible, temporarily disabling the SQLAlchemy data layer element persistence removes the vulnerable path but also disables element storage functionality. Refer to the VulnCheck advisory and the 2.9.4 release notes for authoritative details.