PkgSeer

Vulnerability PYSEC-2026-4028

High Risk

1 month ago

Chainlit contains a session hijacking vulnerability

0.1.0 - 2.10.0

Summary

Chainlit contains a session hijacking vulnerability

Details

Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

2.4.0rc0 - 2.11.1 PYSEC-2026-3811

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

2.4.0rc0 - 2.11.1 PYSEC-2026-3812

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

2.4.0rc0 - 2.11.1 GHSA-hvfh-5mj3-5f3j

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

2.4.0rc0 - 2.11.1 GHSA-w3fx-mc44-mf6j

Chainlit contain a server-side request forgery (SSRF) vulnerability

0.1.0 - 2.9.3 PYSEC-2026-1237

View all vulnerabilities for these packages

Impacted packages

chainlit

Timeline

Published

1 month ago

Fixed (2.10.1)

7 months ago

Last Modified

1 month ago