CVE-2026-120492: Chainlit SSRF — MEDIUM

CISO Take

Chainlit 2.12.0 fails to reject the semicolon character when validating MCP URLs, so an unauthenticated attacker can submit '..;' path segments to the /mcp endpoint and escape the path scope an operator granted, but only on origins that strip semicolon path parameters. Exploitation is rated high complexity because it depends on the backend's path normalization, and the impact is limited to low confidentiality and integrity with a changed scope (CVSS 5.4). There is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so near-term mass exploitation looks unlikely. It still matters for any internet-facing Chainlit deployment that connects to internal MCP servers or APIs, because the server can be made to reach paths the operator never approved. Review the GHSA advisory for the fixed version and upgrade, and until then broaden or tighten allowed_urls to origin-level entries you trust, or put a proxy in front of /mcp that rejects semicolons in URLs.

Sources:NVDGitHub AdvisoryATLASvulncheck.com

What is the risk?

Medium overall. The attack is network-reachable, needs no privileges and no user interaction, and the scope change reflects that requests cross an authorization boundary. High attack complexity lowers likelihood, because the target origin must strip semicolon path parameters (as Tomcat-style or some proxy stacks do). No known exploitation, no public PoC and no scanner template exist. Risk rises sharply where Chainlit is exposed to the internet and the permitted MCP origin also serves sensitive internal paths such as admin or metadata endpoints.

How does the attack unfold?

Initial Access

The attacker reaches the unauthenticated /mcp endpoint of an internet-exposed Chainlit instance.

AML.T0049

Exploitation

The attacker submits an MCP URL containing '..;' segments that passes validate_mcp_url because semicolons are not rejected.

AML.T0053

Scope Escape

The upstream origin strips the semicolon path parameter and resolves the traversal, so the request lands outside the operator's allowed path.

Impact

The attacker obtains limited read or write access to resources on the allowed origin that were not meant to be exposed.

Initial Access

The attacker reaches the unauthenticated /mcp endpoint of an internet-exposed Chainlit instance.

AML.T0049

Exploitation

The attacker submits an MCP URL containing '..;' segments that passes validate_mcp_url because semicolons are not rejected.

AML.T0053

Scope Escape

The upstream origin strips the semicolon path parameter and resolves the traversal, so the request lands outside the operator's allowed path.

Impact

The attacker obtains limited read or write access to resources on the allowed origin that were not meant to be exposed.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Chainlit	pip	—	No patch
12.5K41 dependentsPushed 1mo ago56% patched~74d to patchFull package profile →

Do you use Chainlit? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade Chainlit to the fixed release named in GHSA-hvfh-5mj3-5f3j, since 2.12.0 is the version identified as affected. 2) Until patched, avoid path-scoped allowed_urls entries as a security boundary and rely on origin-level controls instead. 3) Block or reject any request to /mcp whose submitted URL contains ';' or '..' at a WAF or reverse proxy. 4) Restrict network egress from the Chainlit host so it can reach only the intended MCP servers. 5) Require authentication in front of /mcp where possible. 6) Detect by searching access and application logs for /mcp requests containing ';' or '..;' and for unexpected outbound requests from the Chainlit host.

How is it classified?

Auth BypassData LeakageFrameworkPluginAgentAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and managing AI system risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-120492?

Chainlit 2.12.0 fails to reject the semicolon character when validating MCP URLs, so an unauthenticated attacker can submit '..;' path segments to the /mcp endpoint and escape the path scope an operator granted, but only on origins that strip semicolon path parameters. Exploitation is rated high complexity because it depends on the backend's path normalization, and the impact is limited to low confidentiality and integrity with a changed scope (CVSS 5.4). There is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so near-term mass exploitation looks unlikely. It still matters for any internet-facing Chainlit deployment that connects to internal MCP servers or APIs, because the server can be made to reach paths the operator never approved. Review the GHSA advisory for the fixed version and upgrade, and until then broaden or tighten allowed_urls to origin-level entries you trust, or put a proxy in front of /mcp that rejects semicolons in URLs.

Is CVE-2026-120492 actively exploited?

No confirmed active exploitation of CVE-2026-120492 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-120492?

1) Upgrade Chainlit to the fixed release named in GHSA-hvfh-5mj3-5f3j, since 2.12.0 is the version identified as affected. 2) Until patched, avoid path-scoped allowed_urls entries as a security boundary and rely on origin-level controls instead. 3) Block or reject any request to /mcp whose submitted URL contains ';' or '..' at a WAF or reverse proxy. 4) Restrict network egress from the Chainlit host so it can reach only the intended MCP servers. 5) Require authentication in front of /mcp where possible. 6) Detect by searching access and application logs for /mcp requests containing ';' or '..;' and for unexpected outbound requests from the Chainlit host.

What systems are affected by CVE-2026-120492?

This vulnerability affects the following AI/ML architecture patterns: LLM chat application front ends, Agent frameworks using MCP, MCP client integrations.

What is the CVSS score for CVE-2026-120492?

CVE-2026-120492 has a CVSS v3.1 base score of 5.4 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

LLM chat application front endsAgent frameworks using MCPMCP client integrations

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.

Exploitation Scenario

An attacker finds an internet-facing Chainlit app whose operator allows MCP connections only under https://tools.internal.example/public/. The attacker posts an MCP URL such as https://tools.internal.example/public/..;/admin/ to the /mcp endpoint. Chainlit's validation accepts it because it does not reject semicolons, and the upstream server strips the ';' segment, resolves the traversal and serves content from /admin/. The attacker then reads or triggers limited actions on resources the operator never meant to expose.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.