Threats affecting pkg:pypi/Chainlit

Chainlit version 2.12.0 contains a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to bypass path-scoped MCP allowed_urls restrictions by exploiting improper validation of semicolon characters in URLs. Attackers can submit specially crafted URLs with '..;' segments to the /mcp endpoint, enabling requests to unauthorized paths on origins that strip semicolon path parameters. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity.

Chainlit versions prior to 2.10.1 have a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without verifying session ownership. This enables attackers to assume the victim's permissions and roles, potentially invoking tools and accessing data restricted to the authenticated user.