Chainlit command injection via MCP stdio transport allows unauthenticated RCE

What's on the official record

The OSV advisory GHSA-w3fx-mc44-mf6j (alias CVE-2026-45018, CWE-78) reports a CRITICAL command injection in the PyPI package chainlit, fixed in version 2.12.0. The flaw sits in the MCP stdio transport, and the /mcp endpoint requires no authentication. The advisory states a deployment is affected only if it sets features.mcp.enabled = true in .chainlit/config.toml, and that MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. The advisory is dated 25 August 2026.

Assessment

For a platform or AI-stack owner, the record lets you check the pinned chainlit version in any deployed application and whether features.mcp.enabled = true in its .chainlit/config.toml. A deployment below 2.12.0 with MCP enabled carries an unauthenticated remote code execution path on /mcp, so the record supports patching to 2.12.0 or keeping MCP disabled and /mcp unreachable from untrusted networks.

For a deal team, the record lets you scope diligence on a target that runs chainlit by asking for the deployed version and the MCP configuration. A target on an affected version with MCP enabled carries unauthenticated RCE exposure that should be priced or conditioned on remediation before close.

What would change this call

A target's confirmed chainlit version and MCP configuration would move this from a general advisory to a specific exposure finding. A fixed version other than 2.12.0, or a statement that the advisory names no fixed version, would change the remediation guidance.

What to check next

Confidence

Filed 25 October 2026 from the record dated 25 August 2026.

Sources

[1] Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution — https://github.com/advisories/GHSA-w3fx-mc44-mf6j