Chainlit MCP stdio Transport Command Injection Enables Unauthenticated RCE (CVE-2026-45018)

A critical vulnerability disclosed today, CVE-2026-45018, affects Chainlit deployments that enable the Model Context Protocol (MCP) feature. The advisory (GHSA-w3fx-mc44-mf6j) reports that the POST /mcp endpoint's stdio transport accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chainlit/mcp.py checks only the executable name against an allowlist and does not inspect arguments, so a payload like npx -y -c 'ARBITRARY COMMAND' passes validation while executing arbitrary shell commands via StdioServerParameters in backend/chainlit/server.py. No authentication is required to reach the endpoint. A working PoC is public in the advisory.

Why It Matters

This is unauthenticated remote code execution with the privileges of the Chainlit process — as severe as it gets, reflected in the reported CVSS score of 9.8. The affected range spans >=2.4.0rc0, <2.12.0, but only where features.mcp.enabled = true is set in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so exposure is limited to deployments that explicitly opted in to the feature — but for those, the impact is full host compromise, data exfiltration, lateral movement, and potential backdoor installation. A related SSRF issue (CVE-2026-45019) is also called out as mitigated by the same disable/upgrade path.

What Defenders Should Do Now

• Inventory Chainlit deployments and check .chainlit/config.toml for features.mcp.enabled = true.
• If MCP is enabled and you cannot patch immediately, set features.mcp.enabled = false — the advisory states this fully prevents exploitation of both this issue and the SSRF companion.
• Upgrade to 2.12.0 (releasing 2026-08-25), which removes client-supplied fullCommand entirely — stdio servers are now developer-declared in config and selected by name, eliminating the injectable trust boundary. Note this is a breaking config change; review the migration guide before upgrading if you use the legacy [features.mcp.sse]/[features.mcp.stdio]/[features.mcp.streamable-http] sections or allowed_executables.
• Configure an authentication callback on /mcp as defense in depth — even post-upgrade, the advisory notes /mcp remains reachable anonymously without one, allowing unauthenticated spawning of developer-configured stdio servers (no longer RCE, but still unauthenticated process spawning).
• Hunt for process execution from the Chainlit service account, particularly npx/uvx invocations with unexpected arguments, and restrict outbound process-spawning capability on hosts running Chainlit.

This is fresh, developing intel published alongside the 2.12.0 patch — details may be refined as the community tests the fix and workarounds. See the original advisory for full technical detail and credits: GHSA-w3fx-mc44-mf6j.