Chainlit CVE-2026-86099

No special configuration is required beyond the Chainlit service being reachable over the network - the vulnerable code path is in the default socket.io session handling present in all Chainlit deployments through 2.12.0. The CVSS 4.0 vector (PR:N/UI:N/AC:L) confirms exploitation is unauthenticated and requires no user interaction. The scope of destruction is bounded by what the service process user account has write/delete permissions to on the host filesystem; running Chainlit as root or with broad filesystem permissions maximizes blast radius. The upload directory configuration determines the starting point, but the lack of validation allows escape to any accessible path. Exploitation is limited to filesystem deletion - there is no read/exfiltration primitive implied by the CVSS vector (VC:N).

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N) reflects a genuinely dangerous profile: fully network-accessible, zero authentication, no complexity barrier, and high availability impact via recursive directory deletion. The integrity impact is rated low (VI:L), consistent with a write-destructive rather than exfiltration-class flaw - however, directory deletion permanently destroys data, which some assessors would argue warrants VI:H as well. No EPSS score is available for this CVE, and it is not in CISA KEV, reducing urgency for mass-exploitation response but not eliminating priority for internet-exposed deployments. No public exploit code has been identified at time of analysis. Real-world risk is highest for Chainlit instances exposed directly to the internet or to untrusted LAN segments - a single unauthenticated request can trigger recursive deletion of directories the service process has write access to, potentially wiping application data, logs, or even OS directories if the process runs with elevated privileges. Organizations running Chainlit as a low-privilege service in a containerized environment face a lower blast radius but remain vulnerable to application-layer destruction.

An attacker with network access to a Chainlit service endpoint establishes a socket.io connection and supplies a crafted sessionId such as '../../../../critical-app-data' or an absolute path like '/var/log/chainlit'. The service resolves this as a legitimate upload session path and, upon session teardown or cleanup, executes a recursive deletion against the traversed directory - destroying data outside the intended scope without any authentication challenge. No public proof-of-concept has been identified, but the exploitation primitive (client-controlled socket.io parameter → filesystem operation) is straightforward to reproduce from the referenced source code.