Chainlit Package Vulnerability: Command Injection via MCP stdio Transport

Severity

HIGH

Affected component

chainlit (pypi)

Affected versions

< 2.9.4 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.101, <= 0.1.101 or >= 0.1.102, <= 0.1.102 or >= 0.1.103, <= 0.1.103 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.101, <= 0.2.101 or >= 0.2.102, <= 0.2.102 or >= 0.2.103, <= 0.2.103 or >= 0.2.104, <= 0.2.104 or >= 0.2.105, <= 0.2.105 or >= 0.2.106, <= 0.2.106 or >= 0.2.107, <= 0.2.107 or >= 0.2.108, <= 0.2.108 or >= 0.2.109, <= 0.2.109 or >= 0.2.110, <= 0.2.110 or >= 0.2.111, <= 0.2.111 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.101, <= 0.4.101 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.6.0, <= 0.6.0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.401, <= 0.6.401 or >= 0.6.402, <= 0.6.402 or >= 0.7.0, <= 0.7.0 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.3, <= 0.7.3 or >= 0.7.301, <= 0.7.301 or >= 0.7.400, <= 0.7.400 or >= 0.7.500, <= 0.7.500 or >= 0.7.501, <= 0.7.501 or >= 0.7.600rc0, <= 0.7.600rc0 or >= 0.7.600rc1, <= 0.7.600rc1 or >= 0.7.601rc0, <= 0.7.601rc0 or >= 0.7.602, <= 0.7.602 or >= 0.7.602rc0, <= 0.7.602rc0 or >= 0.7.603, <= 0.7.603 or >= 0.7.604, <= 0.7.604 or >= 0.7.604rc0, <= 0.7.604rc0 or >= 0.7.604rc1, <= 0.7.604rc1 or >= 0.7.604rc2, <= 0.7.604rc2 or >= 0.7.700, <= 0.7.700 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc0, <= 1.0.0rc0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.100, <= 1.0.100 or >= 1.0.101, <= 1.0.101 or >= 1.0.200, <= 1.0.200 or >= 1.0.300, <= 1.0.300 or >= 1.0.301, <= 1.0.301 or >= 1.0.400, <= 1.0.400 or >= 1.0.401, <= 1.0.401 or >= 1.0.500, <= 1.0.500 or >= 1.0.501, <= 1.0.501 or >= 1.0.502, <= 1.0.502 or >= 1.0.503, <= 1.0.503 or >= 1.0.504, <= 1.0.504 or >= 1.0.505, <= 1.0.505 or >= 1.0.506, <= 1.0.506 or >= 1.1.0, <= 1.1.0 or >= 1.1.0rc0, <= 1.1.0rc0 or >= 1.1.0rc1, <= 1.1.0rc1 or >= 1.1.101, <= 1.1.101 or >= 1.1.200, <= 1.1.200 or >= 1.1.201, <= 1.1.201 or >= 1.1.202, <= 1.1.202 or >= 1.1.300, <= 1.1.300 or >= 1.1.300rc0, <= 1.1.300rc0 or >= 1.1.300rc1, <= 1.1.300rc1 or >= 1.1.300rc2, <= 1.1.300rc2 or >= 1.1.300rc3, <= 1.1.300rc3 or >= 1.1.300rc4, <= 1.1.300rc4 or >= 1.1.300rc5, <= 1.1.300rc5 or >= 1.1.301, <= 1.1.301 or >= 1.1.302, <= 1.1.302 or >= 1.1.303, <= 1.1.303 or >= 1.1.304, <= 1.1.304 or >= 1.1.305, <= 1.1.305 or >= 1.1.306, <= 1.1.306 or >= 1.1.400, <= 1.1.400 or >= 1.1.400rc0, <= 1.1.400rc0 or >= 1.1.400rc1, <= 1.1.400rc1 or >= 1.1.401, <= 1.1.401 or >= 1.1.402, <= 1.1.402 or >= 1.1.403rc0, <= 1.1.403rc0 or >= 1.1.404, <= 1.1.404 or >= 1.2.0, <= 1.2.0 or >= 1.2.0rc0, <= 1.2.0rc0 or >= 1.3.0, <= 1.3.0 or >= 1.3.0rc0, <= 1.3.0rc0 or >= 1.3.0rc1, <= 1.3.0rc1 or >= 1.3.1, <= 1.3.1 or >= 1.3.2, <= 1.3.2 or >= 2.0.0, <= 2.0.0 or >= 2.0.1, <= 2.0.1 or >= 2.0.2, <= 2.0.2 or >= 2.0.3, <= 2.0.3 or >= 2.0.4, <= 2.0.4 or >= 2.0.5, <= 2.0.5 or >= 2.0.6, <= 2.0.6 or >= 2.0.601, <= 2.0.601 or >= 2.0.602, <= 2.0.602 or >= 2.0.603, <= 2.0.603 or >= 2.0.dev0, <= 2.0.dev0 or >= 2.0.dev1, <= 2.0.dev1 or >= 2.0.dev2, <= 2.0.dev2 or >= 2.0rc0, <= 2.0rc0 or >= 2.0rc1, <= 2.0rc1 or >= 2.1.0, <= 2.1.0 or >= 2.1.1, <= 2.1.1 or >= 2.1.2, <= 2.1.2 or >= 2.2.0, <= 2.2.0 or >= 2.2.1, <= 2.2.1 or >= 2.3.0, <= 2.3.0 or >= 2.4.0, <= 2.4.0 or >= 2.4.0rc0, <= 2.4.0rc0 or >= 2.4.1, <= 2.4.1 or >= 2.4.2, <= 2.4.2 or >= 2.4.201, <= 2.4.201 or >= 2.4.3, <= 2.4.3 or >= 2.4.301, <= 2.4.301 or >= 2.4.302, <= 2.4.302 or >= 2.4.400, <= 2.4.400 or >= 2.5.5, <= 2.5.5 or >= 2.6.0, <= 2.6.0 or >= 2.6.1, <= 2.6.1 or >= 2.6.2, <= 2.6.2 or >= 2.6.3, <= 2.6.3 or >= 2.6.4, <= 2.6.4 or >= 2.6.5, <= 2.6.5 or >= 2.6.6, <= 2.6.6 or >= 2.6.7, <= 2.6.7 or >= 2.6.8, <= 2.6.8 or >= 2.6.9, <= 2.6.9 or >= 2.7.0, <= 2.7.0 or >= 2.7.1, <= 2.7.1 or >= 2.7.1.1, <= 2.7.1.1 or >= 2.7.2, <= 2.7.2 or >= 2.8.0, <= 2.8.0 or >= 2.8.1, <= 2.8.1 or >= 2.8.2, <= 2.8.2 or >= 2.8.3, <= 2.8.3 or >= 2.8.4, <= 2.8.4 or >= 2.8.5, <= 2.8.5 or >= 2.9.0, <= 2.9.0 or >= 2.9.1, <= 2.9.1 or >= 2.9.2, <= 2.9.2 or >= 2.9.3, <= 2.9.3 or < 2.8.5 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.101, <= 0.1.101 or >= 0.1.102, <= 0.1.102 or >= 0.1.103, <= 0.1.103 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.101, <= 0.2.101 or >= 0.2.102, <= 0.2.102 or >= 0.2.103, <= 0.2.103 or >= 0.2.104, <= 0.2.104 or >= 0.2.105, <= 0.2.105 or >= 0.2.106, <= 0.2.106 or >= 0.2.107, <= 0.2.107 or >= 0.2.108, <= 0.2.108 or >= 0.2.109, <= 0.2.109 or >= 0.2.110, <= 0.2.110 or >= 0.2.111, <= 0.2.111 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.101, <= 0.4.101 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.6.0, <= 0.6.0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.401, <= 0.6.401 or >= 0.6.402, <= 0.6.402 or >= 0.7.0, <= 0.7.0 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.3, <= 0.7.3 or >= 0.7.301, <= 0.7.301 or >= 0.7.400, <= 0.7.400 or >= 0.7.500, <= 0.7.500 or >= 0.7.501, <= 0.7.501 or >= 0.7.600rc0, <= 0.7.600rc0 or >= 0.7.600rc1, <= 0.7.600rc1 or >= 0.7.601rc0, <= 0.7.601rc0 or >= 0.7.602, <= 0.7.602 or >= 0.7.602rc0, <= 0.7.602rc0 or >= 0.7.603, <= 0.7.603 or >= 0.7.604, <= 0.7.604 or >= 0.7.604rc0, <= 0.7.604rc0 or >= 0.7.604rc1, <= 0.7.604rc1 or >= 0.7.604rc2, <= 0.7.604rc2 or >= 0.7.700, <= 0.7.700 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc0, <= 1.0.0rc0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.100, <= 1.0.100 or >= 1.0.101, <= 1.0.101 or >= 1.0.200, <= 1.0.200 or >= 1.0.300, <= 1.0.300 or >= 1.0.301, <= 1.0.301 or >= 1.0.400, <= 1.0.400 or >= 1.0.401, <= 1.0.401 or >= 1.0.500, <= 1.0.500 or >= 1.0.501, <= 1.0.501 or >= 1.0.502, <= 1.0.502 or >= 1.0.503, <= 1.0.503 or >= 1.0.504, <= 1.0.504 or >= 1.0.505, <= 1.0.505 or >= 1.0.506, <= 1.0.506 or >= 1.1.0, <= 1.1.0 or >= 1.1.0rc0, <= 1.1.0rc0 or >= 1.1.0rc1, <= 1.1.0rc1 or >= 1.1.101, <= 1.1.101 or >= 1.1.200, <= 1.1.200 or >= 1.1.201, <= 1.1.201 or >= 1.1.202, <= 1.1.202 or >= 1.1.300, <= 1.1.300 or >= 1.1.300rc0, <= 1.1.300rc0 or >= 1.1.300rc1, <= 1.1.300rc1 or >= 1.1.300rc2, <= 1.1.300rc2 or >= 1.1.300rc3, <= 1.1.300rc3 or >= 1.1.300rc4, <= 1.1.300rc4 or >= 1.1.300rc5, <= 1.1.300rc5 or >= 1.1.301, <= 1.1.301 or >= 1.1.302, <= 1.1.302 or >= 1.1.303, <= 1.1.303 or >= 1.1.304, <= 1.1.304 or >= 1.1.305, <= 1.1.305 or >= 1.1.306, <= 1.1.306 or >= 1.1.400, <= 1.1.400 or >= 1.1.400rc0, <= 1.1.400rc0 or >= 1.1.400rc1, <= 1.1.400rc1 or >= 1.1.401, <= 1.1.401 or >= 1.1.402, <= 1.1.402 or >= 1.1.403rc0, <= 1.1.403rc0 or >= 1.1.404, <= 1.1.404 or >= 1.2.0, <= 1.2.0 or >= 1.2.0rc0, <= 1.2.0rc0 or >= 1.3.0, <= 1.3.0 or >= 1.3.0rc0, <= 1.3.0rc0 or >= 1.3.0rc1, <= 1.3.0rc1 or >= 1.3.1, <= 1.3.1 or >= 1.3.2, <= 1.3.2 or >= 2.0.0, <= 2.0.0 or >= 2.0.1, <= 2.0.1 or >= 2.0.2, <= 2.0.2 or >= 2.0.3, <= 2.0.3 or >= 2.0.4, <= 2.0.4 or >= 2.0.5, <= 2.0.5 or >= 2.0.6, <= 2.0.6 or >= 2.0.601, <= 2.0.601 or >= 2.0.602, <= 2.0.602 or >= 2.0.603, <= 2.0.603 or >= 2.0.dev0, <= 2.0.dev0 or >= 2.0.dev1, <= 2.0.dev1 or >= 2.0.dev2, <= 2.0.dev2 or >= 2.0rc0, <= 2.0rc0 or >= 2.0rc1, <= 2.0rc1 or >= 2.1.0, <= 2.1.0 or >= 2.1.1, <= 2.1.1 or >= 2.1.2, <= 2.1.2 or >= 2.2.0, <= 2.2.0 or >= 2.2.1, <= 2.2.1 or >= 2.3.0, <= 2.3.0 or >= 2.4.0, <= 2.4.0 or >= 2.4.0rc0, <= 2.4.0rc0 or >= 2.4.1, <= 2.4.1 or >= 2.4.2, <= 2.4.2 or >= 2.4.201, <= 2.4.201 or >= 2.4.3, <= 2.4.3 or >= 2.4.301, <= 2.4.301 or >= 2.4.302, <= 2.4.302 or >= 2.4.400, <= 2.4.400 or >= 2.5.5, <= 2.5.5 or >= 2.6.0, <= 2.6.0 or >= 2.6.1, <= 2.6.1 or >= 2.6.2, <= 2.6.2 or >= 2.6.3, <= 2.6.3 or >= 2.6.4, <= 2.6.4 or >= 2.6.5, <= 2.6.5 or >= 2.6.6, <= 2.6.6 or >= 2.6.7, <= 2.6.7 or >= 2.6.8, <= 2.6.8 or >= 2.6.9, <= 2.6.9 or >= 2.7.0, <= 2.7.0 or >= 2.7.1, <= 2.7.1 or >= 2.7.1.1, <= 2.7.1.1 or >= 2.7.2, <= 2.7.2 or >= 2.8.0, <= 2.8.0 or >= 2.8.1, <= 2.8.1 or >= 2.8.2, <= 2.8.2 or >= 2.8.3, <= 2.8.3 or >= 2.8.4, <= 2.8.4 or < 2.9.4 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.101, <= 0.1.101 or >= 0.1.102, <= 0.1.102 or >= 0.1.103, <= 0.1.103 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.101, <= 0.2.101 or >= 0.2.102, <= 0.2.102 or >= 0.2.103, <= 0.2.103 or >= 0.2.104, <= 0.2.104 or >= 0.2.105, <= 0.2.105 or >= 0.2.106, <= 0.2.106 or >= 0.2.107, <= 0.2.107 or >= 0.2.108, <= 0.2.108 or >= 0.2.109, <= 0.2.109 or >= 0.2.110, <= 0.2.110 or >= 0.2.111, <= 0.2.111 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.101, <= 0.4.101 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.6.0, <= 0.6.0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.401, <= 0.6.401 or >= 0.6.402, <= 0.6.402 or >= 0.7.0, <= 0.7.0 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.3, <= 0.7.3 or >= 0.7.301, <= 0.7.301 or >= 0.7.400, <= 0.7.400 or >= 0.7.500, <= 0.7.500 or >= 0.7.501, <= 0.7.501 or >= 0.7.600rc0, <= 0.7.600rc0 or >= 0.7.600rc1, <= 0.7.600rc1 or >= 0.7.601rc0, <= 0.7.601rc0 or >= 0.7.602, <= 0.7.602 or >= 0.7.602rc0, <= 0.7.602rc0 or >= 0.7.603, <= 0.7.603 or >= 0.7.604, <= 0.7.604 or >= 0.7.604rc0, <= 0.7.604rc0 or >= 0.7.604rc1, <= 0.7.604rc1 or >= 0.7.604rc2, <= 0.7.604rc2 or >= 0.7.700, <= 0.7.700 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc0, <= 1.0.0rc0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.100, <= 1.0.100 or >= 1.0.101, <= 1.0.101 or >= 1.0.200, <= 1.0.200 or >= 1.0.300, <= 1.0.300 or >= 1.0.301, <= 1.0.301 or >= 1.0.400, <= 1.0.400 or >= 1.0.401, <= 1.0.401 or >= 1.0.500, <= 1.0.500 or >= 1.0.501, <= 1.0.501 or >= 1.0.502, <= 1.0.502 or >= 1.0.503, <= 1.0.503 or >= 1.0.504, <= 1.0.504 or >= 1.0.505, <= 1.0.505 or >= 1.0.506, <= 1.0.506 or >= 1.1.0, <= 1.1.0 or >= 1.1.0rc0, <= 1.1.0rc0 or >= 1.1.0rc1, <= 1.1.0rc1 or >= 1.1.101, <= 1.1.101 or >= 1.1.200, <= 1.1.200 or >= 1.1.201, <= 1.1.201 or >= 1.1.202, <= 1.1.202 or >= 1.1.300, <= 1.1.300 or >= 1.1.300rc0, <= 1.1.300rc0 or >= 1.1.300rc1, <= 1.1.300rc1 or >= 1.1.300rc2, <= 1.1.300rc2 or >= 1.1.300rc3, <= 1.1.300rc3 or >= 1.1.300rc4, <= 1.1.300rc4 or >= 1.1.300rc5, <= 1.1.300rc5 or >= 1.1.301, <= 1.1.301 or >= 1.1.302, <= 1.1.302 or >= 1.1.303, <= 1.1.303 or >= 1.1.304, <= 1.1.304 or >= 1.1.305, <= 1.1.305 or >= 1.1.306, <= 1.1.306 or >= 1.1.400, <= 1.1.400 or >= 1.1.400rc0, <= 1.1.400rc0 or >= 1.1.400rc1, <= 1.1.400rc1 or >= 1.1.401, <= 1.1.401 or >= 1.1.402, <= 1.1.402 or >= 1.1.403rc0, <= 1.1.403rc0 or >= 1.1.404, <= 1.1.404 or >= 1.2.0, <= 1.2.0 or >= 1.2.0rc0, <= 1.2.0rc0 or >= 1.3.0, <= 1.3.0 or >= 1.3.0rc0, <= 1.3.0rc0 or >= 1.3.0rc1, <= 1.3.0rc1 or >= 1.3.1, <= 1.3.1 or >= 1.3.2, <= 1.3.2 or >= 2.0.0, <= 2.0.0 or >= 2.0.1, <= 2.0.1 or >= 2.0.2, <= 2.0.2 or >= 2.0.3, <= 2.0.3 or >= 2.0.4, <= 2.0.4 or >= 2.0.5, <= 2.0.5 or >= 2.0.6, <= 2.0.6 or >= 2.0.601, <= 2.0.601 or >= 2.0.602, <= 2.0.602 or >= 2.0.603, <= 2.0.603 or >= 2.0.dev0, <= 2.0.dev0 or >= 2.0.dev1, <= 2.0.dev1 or >= 2.0.dev2, <= 2.0.dev2 or >= 2.0rc0, <= 2.0rc0 or >= 2.0rc1, <= 2.0rc1 or >= 2.1.0, <= 2.1.0 or >= 2.1.1, <= 2.1.1 or >= 2.1.2, <= 2.1.2 or >= 2.2.0, <= 2.2.0 or >= 2.2.1, <= 2.2.1 or >= 2.3.0, <= 2.3.0 or >= 2.4.0, <= 2.4.0 or >= 2.4.0rc0, <= 2.4.0rc0 or >= 2.4.1, <= 2.4.1 or >= 2.4.2, <= 2.4.2 or >= 2.4.201, <= 2.4.201 or >= 2.4.3, <= 2.4.3 or >= 2.4.301, <= 2.4.301 or >= 2.4.302, <= 2.4.302 or >= 2.4.400, <= 2.4.400 or >= 2.5.5, <= 2.5.5 or >= 2.6.0, <= 2.6.0 or >= 2.6.1, <= 2.6.1 or >= 2.6.2, <= 2.6.2 or >= 2.6.3, <= 2.6.3 or >= 2.6.4, <= 2.6.4 or >= 2.6.5, <= 2.6.5 or >= 2.6.6, <= 2.6.6 or >= 2.6.7, <= 2.6.7 or >= 2.6.8, <= 2.6.8 or >= 2.6.9, <= 2.6.9 or >= 2.7.0, <= 2.7.0 or >= 2.7.1, <= 2.7.1 or >= 2.7.1.1, <= 2.7.1.1 or >= 2.7.2, <= 2.7.2 or >= 2.8.0, <= 2.8.0 or >= 2.8.1, <= 2.8.1 or >= 2.8.2, <= 2.8.2 or >= 2.8.3, <= 2.8.3 or >= 2.8.4, <= 2.8.4 or >= 2.8.5, <= 2.8.5 or >= 2.9.0, <= 2.9.0 or >= 2.9.1, <= 2.9.1 or >= 2.9.2, <= 2.9.2 or >= 2.9.3, <= 2.9.3 or < 2.8.5 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.101, <= 0.1.101 or >= 0.1.102, <= 0.1.102 or >= 0.1.103, <= 0.1.103 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.101, <= 0.2.101 or >= 0.2.102, <= 0.2.102 or >= 0.2.103, <= 0.2.103 or >= 0.2.104, <= 0.2.104 or >= 0.2.105, <= 0.2.105 or >= 0.2.106, <= 0.2.106 or >= 0.2.107, <= 0.2.107 or >= 0.2.108, <= 0.2.108 or >= 0.2.109, <= 0.2.109 or >= 0.2.110, <= 0.2.110 or >= 0.2.111, <= 0.2.111 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.101, <= 0.4.101 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.6.0, <= 0.6.0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.401, <= 0.6.401 or >= 0.6.402, <= 0.6.402 or >= 0.7.0, <= 0.7.0 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.3, <= 0.7.3 or >= 0.7.301, <= 0.7.301 or >= 0.7.400, <= 0.7.400 or >= 0.7.500, <= 0.7.500 or >= 0.7.501, <= 0.7.501 or >= 0.7.600rc0, <= 0.7.600rc0 or >= 0.7.600rc1, <= 0.7.600rc1 or >= 0.7.601rc0, <= 0.7.601rc0 or >= 0.7.602, <= 0.7.602 or >= 0.7.602rc0, <= 0.7.602rc0 or >= 0.7.603, <= 0.7.603 or >= 0.7.604, <= 0.7.604 or >= 0.7.604rc0, <= 0.7.604rc0 or >= 0.7.604rc1, <= 0.7.604rc1 or >= 0.7.604rc2, <= 0.7.604rc2 or >= 0.7.700, <= 0.7.700 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc0, <= 1.0.0rc0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.100, <= 1.0.100 or >= 1.0.101, <= 1.0.101 or >= 1.0.200, <= 1.0.200 or >= 1.0.300, <= 1.0.300 or >= 1.0.301, <= 1.0.301 or >= 1.0.400, <= 1.0.400 or >= 1.0.401, <= 1.0.401 or >= 1.0.500, <= 1.0.500 or >= 1.0.501, <= 1.0.501 or >= 1.0.502, <= 1.0.502 or >= 1.0.503, <= 1.0.503 or >= 1.0.504, <= 1.0.504 or >= 1.0.505, <= 1.0.505 or >= 1.0.506, <= 1.0.506 or >= 1.1.0, <= 1.1.0 or >= 1.1.0rc0, <= 1.1.0rc0 or >= 1.1.0rc1, <= 1.1.0rc1 or >= 1.1.101, <= 1.1.101 or >= 1.1.200, <= 1.1.200 or >= 1.1.201, <= 1.1.201 or >= 1.1.202, <= 1.1.202 or >= 1.1.300, <= 1.1.300 or >= 1.1.300rc0, <= 1.1.300rc0 or >= 1.1.300rc1, <= 1.1.300rc1 or >= 1.1.300rc2, <= 1.1.300rc2 or >= 1.1.300rc3, <= 1.1.300rc3 or >= 1.1.300rc4, <= 1.1.300rc4 or >= 1.1.300rc5, <= 1.1.300rc5 or >= 1.1.301, <= 1.1.301 or >= 1.1.302, <= 1.1.302 or >= 1.1.303, <= 1.1.303 or >= 1.1.304, <= 1.1.304 or >= 1.1.305, <= 1.1.305 or >= 1.1.306, <= 1.1.306 or >= 1.1.400, <= 1.1.400 or >= 1.1.400rc0, <= 1.1.400rc0 or >= 1.1.400rc1, <= 1.1.400rc1 or >= 1.1.401, <= 1.1.401 or >= 1.1.402, <= 1.1.402 or >= 1.1.403rc0, <= 1.1.403rc0 or >= 1.1.404, <= 1.1.404 or >= 1.2.0, <= 1.2.0 or >= 1.2.0rc0, <= 1.2.0rc0 or >= 1.3.0, <= 1.3.0 or >= 1.3.0rc0, <= 1.3.0rc0 or >= 1.3.0rc1, <= 1.3.0rc1 or >= 1.3.1, <= 1.3.1 or >= 1.3.2, <= 1.3.2 or >= 2.0.0, <= 2.0.0 or >= 2.0.1, <= 2.0.1 or >= 2.0.2, <= 2.0.2 or >= 2.0.3, <= 2.0.3 or >= 2.0.4, <= 2.0.4 or >= 2.0.5, <= 2.0.5 or >= 2.0.6, <= 2.0.6 or >= 2.0.601, <= 2.0.601 or >= 2.0.602, <= 2.0.602 or >= 2.0.603, <= 2.0.603 or >= 2.0.dev0, <= 2.0.dev0 or >= 2.0.dev1, <= 2.0.dev1 or >= 2.0.dev2, <= 2.0.dev2 or >= 2.0rc0, <= 2.0rc0 or >= 2.0rc1, <= 2.0rc1 or >= 2.1.0, <= 2.1.0 or >= 2.1.1, <= 2.1.1 or >= 2.1.2, <= 2.1.2 or >= 2.2.0, <= 2.2.0 or >= 2.2.1, <= 2.2.1 or >= 2.3.0, <= 2.3.0 or >= 2.4.0, <= 2.4.0 or >= 2.4.0rc0, <= 2.4.0rc0 or >= 2.4.1, <= 2.4.1 or >= 2.4.2, <= 2.4.2 or >= 2.4.201, <= 2.4.201 or >= 2.4.3, <= 2.4.3 or >= 2.4.301, <= 2.4.301 or >= 2.4.302, <= 2.4.302 or >= 2.4.400, <= 2.4.400 or >= 2.5.5, <= 2.5.5 or >= 2.6.0, <= 2.6.0 or >= 2.6.1, <= 2.6.1 or >= 2.6.2, <= 2.6.2 or >= 2.6.3, <= 2.6.3 or >= 2.6.4, <= 2.6.4 or >= 2.6.5, <= 2.6.5 or >= 2.6.6, <= 2.6.6 or >= 2.6.7, <= 2.6.7 or >= 2.6.8, <= 2.6.8 or >= 2.6.9, <= 2.6.9 or >= 2.7.0, <= 2.7.0 or >= 2.7.1, <= 2.7.1 or >= 2.7.1.1, <= 2.7.1.1 or >= 2.7.2, <= 2.7.2 or >= 2.8.0, <= 2.8.0 or >= 2.8.1, <= 2.8.1 or >= 2.8.2, <= 2.8.2 or >= 2.8.3, <= 2.8.3 or >= 2.8.4, <= 2.8.4 or < 2.9.4 or >= 0.1.0, <= 0.1.0 or >= 0.1.1, <= 0.1.1 or >= 0.1.101, <= 0.1.101 or >= 0.1.102, <= 0.1.102 or >= 0.1.103, <= 0.1.103 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.101, <= 0.2.101 or >= 0.2.102, <= 0.2.102 or >= 0.2.103, <= 0.2.103 or >= 0.2.104, <= 0.2.104 or >= 0.2.105, <= 0.2.105 or >= 0.2.106, <= 0.2.106 or >= 0.2.107, <= 0.2.107 or >= 0.2.108, <= 0.2.108 or >= 0.2.109, <= 0.2.109 or >= 0.2.110, <= 0.2.110 or >= 0.2.111, <= 0.2.111 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.101, <= 0.4.101 or >= 0.4.2, <= 0.4.2 or >= 0.4.3, <= 0.4.3 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.6.0, <= 0.6.0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.401, <= 0.6.401 or >= 0.6.402, <= 0.6.402 or >= 0.7.0, <= 0.7.0 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.3, <= 0.7.3 or >= 0.7.301, <= 0.7.301 or >= 0.7.400, <= 0.7.400 or >= 0.7.500, <= 0.7.500 or >= 0.7.501, <= 0.7.501 or >= 0.7.600rc0, <= 0.7.600rc0 or >= 0.7.600rc1, <= 0.7.600rc1 or >= 0.7.601rc0, <= 0.7.601rc0 or >= 0.7.602, <= 0.7.602 or >= 0.7.602rc0, <= 0.7.602rc0 or >= 0.7.603, <= 0.7.603 or >= 0.7.604, <= 0.7.604 or >= 0.7.604rc0, <= 0.7.604rc0 or >= 0.7.604rc1, <= 0.7.604rc1 or >= 0.7.604rc2, <= 0.7.604rc2 or >= 0.7.700, <= 0.7.700 or >= 1.0.0, <= 1.0.0 or >= 1.0.0rc0, <= 1.0.0rc0 or >= 1.0.0rc1, <= 1.0.0rc1 or >= 1.0.0rc2, <= 1.0.0rc2 or >= 1.0.0rc3, <= 1.0.0rc3 or >= 1.0.100, <= 1.0.100 or >= 1.0.101, <= 1.0.101 or >= 1.0.200, <= 1.0.200 or >= 1.0.300, <= 1.0.300 or >= 1.0.301, <= 1.0.301 or >= 1.0.400, <= 1.0.400 or >= 1.0.401, <= 1.0.401 or >= 1.0.500, <= 1.0.500 or >= 1.0.501, <= 1.0.501 or >= 1.0.502, <= 1.0.502 or >= 1.0.503, <= 1.0.503 or >= 1.0.504, <= 1.0.504 or >= 1.0.505, <= 1.0.505 or >= 1.0.506, <= 1.0.506 or >= 1.1.0, <= 1.1.0 or >= 1.1.0rc0, <= 1.1.0rc0 or >= 1.1.0rc1, <= 1.1.0rc1 or >= 1.1.101, <= 1.1.101 or >= 1.1.200, <= 1.1.200 or >= 1.1.201, <= 1.1.201 or >= 1.1.202, <= 1.1.202 or >= 1.1.300, <= 1.1.300 or >= 1.1.300rc0, <= 1.1.300rc0 or >= 1.1.300rc1, <= 1.1.300rc1 or >= 1.1.300rc2, <= 1.1.300rc2 or >= 1.1.300rc3, <= 1.1.300rc3 or >= 1.1.300rc4, <= 1.1.300rc4 or >= 1.1.300rc5, <= 1.1.300rc5 or >= 1.1.301, <= 1.1.301 or >= 1.1.302, <= 1.1.302 or >= 1.1.303, <= 1.1.303 or >= 1.1.304, <= 1.1.304 or >= 1.1.305, <= 1.1.305 or >= 1.1.306, <= 1.1.306 or >= 1.1.400, <= 1.1.400 or >= 1.1.400rc0, <= 1.1.400rc0 or >= 1.1.400rc1, <= 1.1.400rc1 or >= 1.1.401, <= 1.1.401 or >= 1.1.402, <= 1.1.402 or >= 1.1.403rc0, <= 1.1.403rc0 or >= 1.1.404, <= 1.1.404 or >= 1.2.0, <= 1.2.0 or >= 1.2.0rc0, <= 1.2.0rc0 or >= 1.3.0, <= 1.3.0 or >= 1.3.0rc0, <= 1.3.0rc0 or >= 1.3.0rc1, <= 1.3.0rc1 or >= 1.3.1, <= 1.3.1 or >= 1.3.2, <= 1.3.2 or >= 2.0.0, <= 2.0.0 or >= 2.0.1, <= 2.0.1 or >= 2.0.2, <= 2.0.2 or >= 2.0.3, <= 2.0.3 or >= 2.0.4, <= 2.0.4 or >= 2.0.5, <= 2.0.5 or >= 2.0.6, <= 2.0.6 or >= 2.0.601, <= 2.0.601 or >= 2.0.602, <= 2.0.602 or >= 2.0.603, <= 2.0.603 or >= 2.0.dev0, <= 2.0.dev0 or >= 2.0.dev1, <= 2.0.dev1 or >= 2.0.dev2, <= 2.0.dev2 or >= 2.0rc0, <= 2.0rc0 or >= 2.0rc1, <= 2.0rc1 or >= 2.1.0, <= 2.1.0 or >= 2.1.1, <= 2.1.1 or >= 2.1.2, <= 2.1.2 or >= 2.2.0, <= 2.2.0 or >= 2.2.1, <= 2.2.1 or >= 2.3.0, <= 2.3.0 or >= 2.4.0, <= 2.4.0 or >= 2.4.0rc0, <= 2.4.0rc0 or >= 2.4.1, <= 2.4.1 or >= 2.4.2, <= 2.4.2 or >= 2.4.201, <= 2.4.201 or >= 2.4.3, <= 2.4.3 or >= 2.4.301, <= 2.4.301 or >= 2.4.302, <= 2.4.302 or >= 2.4.400, <= 2.4.400 or >= 2.5.5, <= 2.5.5 or >= 2.6.0, <= 2.6.0 or >= 2.6.1, <= 2.6.1 or >= 2.6.2, <= 2.6.2 or >= 2.6.3, <= 2.6.3 or >= 2.6.4, <= 2.6.4 or >= 2.6.5, <= 2.6.5 or >= 2.6.6, <= 2.6.6 or >= 2.6.7, <= 2.6.7 or >= 2.6.8, <= 2.6.8 or >= 2.6.9, <= 2.6.9 or >= 2.7.0, <= 2.7.0 or >= 2.7.1, <= 2.7.1 or >= 2.7.1.1, <= 2.7.1.1 or >= 2.7.2, <= 2.7.2 or >= 2.8.0, <= 2.8.0 or >= 2.8.1, <= 2.8.1 or >= 2.8.2, <= 2.8.2 or >= 2.8.3, <= 2.8.3 or >= 2.8.4, <= 2.8.4 or >= 2.8.5, <= 2.8.5 or >= 2.9.0, <= 2.9.0 or >= 2.9.1, <= 2.9.1 or >= 2.9.2, <= 2.9.2 or >= 2.9.3, <= 2.9.3

Patched version

2.12.0

An early warning has been issued for a critical vulnerability in the Chainlit package, which allows unauthenticated remote code execution via command injection through the MCP stdio transport. This affects versions from 2.4.0rc0 to 2.11.1.

What happened

The Chainlit package has been reported to contain a critical vulnerability identified as CVE-2026-45018. This vulnerability involves command injection through the MCP stdio transport, enabling unauthenticated remote code execution. The affected versions range from 2.4.0rc0 to 2.11.1. The vulnerability was first flagged on August 25, 2026.

Users of Chainlit should assess their exposure by checking the versions of Chainlit in use within their systems. The vulnerability is severe and could allow an attacker to execute arbitrary code on the affected system without authentication.

What to do about it

• Immediately check the version of Chainlit in use in your environment.
• Upgrade to Chainlit version 2.12.0 or higher to mitigate the vulnerability.
• Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.

How 0Day would have caught this

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Sources

• [GHSA-w3fx-mc44-mf6j] Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Join the 0Day waitlist →

← Back to all threats