Chainlit's MCP endpoint took shell commands from anyone who could reach it

What happened

Where Chainlit's MCP feature is enabled, the framework exposed POST /mcp with no authentication at all. For stdio transport the endpoint took a user-supplied command string and checked only the executable name against an allowlist, passing the arguments through unchecked. Because npx accepts a shell flag, an unauthenticated caller got arbitrary commands with the privileges of the Chainlit process. The advisory rates it 9.8, critical.

If the allowlist is left unset, the default is treated as permitting every executable. Releases from 2.4.0rc0 to 2.11.1 are affected and 2.12.0 carries the fix, alongside a companion server-side request forgery through the streamable-http and SSE transports, CVE-2026-45019, rated 7.2. Chainlit credits Vipin and Stephen of SPL Security, who disclosed to the project on 8 April 2026, four and a half months before the advisory went out.