Live › vulnerability › CVE-2026-120492
Chainlit 2.12.0 fails to reject semicolons in MCP URLs, so the allowed_urls path restriction can be bypassed with '..;' segments sent to the /mcp endpoint. An unauthenticated attacker can make the server send requests to paths the operator did not grant, on origins that strip semicolon path parameters.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Chainlit 2.12.0 deployments that turned on MCP (off by default) with user-provided servers and a path-limited allowed_urls entry. A client can send '..;' segments to /mcp and reach other paths on the same origin, but only where the target strips semicolon path parameters. With no auth callback the client needs no login. Skip it if MCP is disabled, if allowed_urls entries are whole origins (nothing to escape), or if you are not on 2.12.0.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| chainlit | pypi | 2.12.0 | – |
pip show chainlit; 2.12.0 is the version VulnCheck lists2.12.02.12.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.
This page as .md · .json · in your agent: get_signal("CVE-2026-120492")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.