Chainlit CVE-2026-45018

Requires features.mcp.enabled = true in .chainlit/config.toml - this is NOT the default (MCP has been disabled by default since v2.7.0), so vulnerable instances are those where an operator explicitly turned MCP on. The stdio transport must be usable and the allowlist must permit an executable that can run arbitrary commands (e.g. npx via its -c flag, or uvx); note that if allowed_executables is left unset it defaults to None and permits every executable. No authentication or user interaction is needed once MCP is enabled: the /mcp route is registered unconditionally and reachable by any client that can open a session (CVSS PR:N/UI:N). Limiting factors that reduce realistic exposure: the non-default enablement requirement, and any deployment that has placed /mcp behind an auth layer or network restrictions.

This is a genuine top-priority issue for any deployment that meets the trigger condition, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8) aligns with the advisory: the /mcp endpoint requires no authentication (any client that can open a session reaches it) and the payload path is low-complexity, so an operator running an exposed instance should treat host compromise as the realistic outcome and patch urgently. The strongest mitigating factor is that exploitation requires a non-default configuration - features.mcp.enabled = true - and MCP has shipped disabled by default since v2.7.0, so the base score overstates risk for the majority of deployments that never enabled MCP. Working proof-of-concept exploits exist (developed by the SPL Security reporters and partially published in the GHSA advisory), which raises practical exploitability, but the CVE is not in CISA KEV and no EPSS score was provided in the input, so there is no confirmed evidence of active in-the-wild exploitation yet. Net: for the subset of Chainlit hosts with MCP explicitly enabled, this is an urgent, patch-now RCE; for the default-configured majority, real-world risk is low pending a config change.

An attacker locates an internet-reachable Chainlit app that has features.mcp.enabled = true, opens an unauthenticated Socket.IO session to obtain a valid sessionId, and sends a POST /mcp request selecting stdio transport with fullCommand set to 'npx -y -c "<attacker shell payload>"'. The allowlist passes because the executable is npx, and the arguments run the payload as the Chainlit process, giving full host command execution. A working proof-of-concept was demonstrated against Chainlit 2.11.0 with default MCP settings.