CVE-2026-120492

Description

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: MEDIUM
CVSS score: 6.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Effective score: 6.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-918
Reserved: 2026-11-02
Published: 2026-11-02 14:29 UTC
Last updated: 2026-11-02 14:29 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120492.json

Affected products (1)

Vendor	Product	Versions	Platforms
Chainlit	Chainlit	`2.12.0` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

GitHub Security Advisory (GHSA-hvfh-5mj3-5f3j) vendor-advisory
https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L90-L177 technical-description
https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L199-L208 technical-description
VulnCheck Advisory: Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-120492.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/chainlit",
          "product": "Chainlit",
          "repo": "https://github.com/Chainlit/chainlit",
          "vendor": "Chainlit",
          "versions": [
            {
              "status": "affected",
              "version": "2.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:chainlit:chainlit:2.12.0:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gavin Blacklock"
        }
      ],
      "datePublic": "2026-11-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T14:29:20.711Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hvfh-5mj3-5f3j)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L90-L177"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L199-L208"
        },
        {
          "name": "VulnCheck Advisory: Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/chainlit-2.12.0-ssrf-via-semicolon-path-segment-in-mcp-allowed-urls"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-120492",
    "datePublished": "2026-11-02T14:29:20.711Z",
    "dateReserved": "2026-11-02T14:15:21.510Z",
    "dateUpdated": "2026-11-02T14:29:20.711Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}