Chainlit MCP stdio Transport Command Injection (CVE-2026-45018)

let chainlitParents = dynamic(["chainlit", "uvicorn", "gunicorn", "python", "python3"]);
let shellChildren = dynamic(["sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "pwsh.exe"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName has_any (chainlitParents)
    or InitiatingProcessCommandLine has "chainlit"
| where FileName in~ (shellChildren)
    or ProcessCommandLine has_any ("; ", "&&", "|", "$(", "`", ">/", "curl ", "wget ", "/dev/tcp/", "nc ", "bash -i")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, FolderPath
| order by Timestamp desc

index=edr sourcetype IN ("crowdstrike:events:sensor","sysmon:process","linux:audit:process")
| where (like(parent_process_name,"%chainlit%") OR like(parent_process_name,"%uvicorn%") OR like(parent_process_name,"%python%") OR like(parent_process,"%chainlit%"))
| where (process_name IN ("sh","bash","dash","zsh","cmd.exe","powershell.exe","pwsh.exe") OR match(process,"(;|&&|\|\||\$\(|`|/dev/tcp/|bash -i|curl |wget |nc )"))
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as process by host parent_process_name process_name user
| convert ctime(firstTime) ctime(lastTime)
| sort - count

process where event.type == "start" and
  process.parent.name in ("chainlit", "uvicorn", "gunicorn", "python", "python3") and
  (
    process.name in ("sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "pwsh.exe") or
    process.command_line : ("*;*", "*&&*", "*|*", "*$(*", "*`*", "*/dev/tcp/*", "*bash -i*", "*curl *", "*wget *", "*nc *")
  )

SELECT QIDNAME(qid) AS event, "parentProcessName", "Process Name" AS processName, "Process CommandLine" AS cmd, username, sourceip, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE ("parentProcessName" ILIKE '%chainlit%' OR "parentProcessName" ILIKE '%uvicorn%' OR "parentProcessName" ILIKE '%python%') AND ("Process Name" IN ('sh','bash','dash','zsh','cmd.exe','powershell.exe','pwsh.exe') OR "Process CommandLine" IMATCHES '.*(;|&&|\|\||\$\(|`|/dev/tcp/|bash -i|curl |wget |nc ).*') ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*edr* (chainlit OR uvicorn OR python)
| json field=_raw "parent_process_name", "process_name", "command_line", "user", "host" as parent, proc, cmd, user, host nodrop
| where (parent matches "*chainlit*" or parent matches "*uvicorn*" or parent matches "*python*")
| where (proc in ("sh","bash","dash","zsh","cmd.exe","powershell.exe","pwsh.exe") or cmd matches /(;|&&|\|\||\$\(|`|\/dev\/tcp\/|bash -i|curl |wget |nc )/)
| count by host, parent, proc, user, cmd
| sort by _count

rule chainlit_mcp_command_injection_CVE_2026_45018 {
  meta:
    author = "Argus"
    description = "Chainlit MCP stdio command injection RCE (CVE-2026-45018)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    ($e.principal.process.parent_process.file.full_path = /chainlit|uvicorn|python/ nocase)
    (
      $e.target.process.file.full_path = /(\/|\\)(sh|bash|dash|zsh|cmd\.exe|powershell\.exe|pwsh\.exe)$/ nocase or
      $e.target.process.command_line = /(;|&&|\|\||\$\(|`|\/dev\/tcp\/|bash -i|curl |wget |nc )/ nocase
    )
    $host = $e.principal.hostname
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| (ParentBaseFileName=/chainlit|uvicorn|python/i OR ImageFileName=/chainlit|uvicorn|python/i)
| ImageFileName=/(sh|bash|dash|zsh|cmd\.exe|powershell\.exe|pwsh\.exe)$/i OR CommandLine=/(;|&&|\|\||\$\(|`|\/dev\/tcp\/|bash -i|curl |wget |nc )/i
| groupBy([aid, ParentBaseFileName, ImageFileName, UserName, CommandLine], function=count())
| sort(count, order=desc)