Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-27 · high
The GitHub advisory says the checker inspects the executable name only, ignoring every argument passed alongside it.
Why now: GitHub published the advisory on August 25.
A GitHub advisory discloses unauthenticated remote code execution in Chainlit's MCP endpoint, tracked as CVE-2026-45018. The GitHub advisory, rated critical and published August 25, covers Chainlit versions 2.4.0rc0 through 2.11.x.
No login is required to trigger it. The only thing limiting exposure is that MCP has shipped disabled by default since Chainlit v2.7.0. The bug only bites deployments that turned the feature on.
The bug sits in validate_mcp_command(). When a deployment enables features.mcp.enabled, POST /mcp accepts a user-controlled fullCommand for stdio-based tool connections. The function checks that command against an allowlist of executable names, but it doesn't inspect the arguments. Send npx -y -c '<command>' and the executable name passes the check, while -c hands arbitrary code to the server process.
A second flaw in the same endpoint, CVE-2026-45019, rates high severity. Its sse and streamable-http transports accept an arbitrary url parameter. They also pass through attacker-controlled Authorization and Cookie headers, turning the endpoint into a server-side request forgery tool against internal services.
Anyone who explicitly turned the feature on, in any version from 2.4.0rc0 through 2.11.x, is exposed until they patch to 2.12.0 or disable it.
Each link below shares sources, entities, or timing with this story.
CVE-2026-45018 covers Chainlit >=2.4.0rc0 <2.12.0. With features.mcp.enabled = true, POST /mcp accepts a user-controlled fullCommand for stdio transport. validate_mcp_command() checks the executable name against an allowlist and never inspects arguments, so npx -y -c '<command...
The mismatch let a faked tool name slip past every human approval, allow-list, and audit log built to stop it.
The update also forces orchestrator-owned browser daemons to fail closed on shutdown instead of leaving a session open.
It logs edits and errors to SQLite and retrieves them by search, skipping re-reads after compaction, enforced across 17 agent platforms.
Two of the six hid commands from the approval dialog itself, using tab padding, invisible Unicode, and split Bash strings.
The open-source project replaces vector search with ls and find commands, and its LoCoMo scores go from 24-57% to 80-83% accuracy.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.