A critical OS command injection vulnerability in Chainlit allows unauthenticated attackers to execute arbitrary code on the underlying host system.

This is an OS command injection vulnerability (CWE-78) occurring in the backend/chainlit/mcp.py file. An unauthenticated attacker can supply a crafted command string to the POST /mcp endpoint, which is then improperly sanitized and executed by the system shell.

Successful exploitation grants an attacker full control over the server process, potentially leading to total system compromise, data exfiltration, and lateral movement within the network. Given the CVSS score of 9.8, this vulnerability represents an extreme risk to confidentiality, integrity, and availability that requires immediate remediation.

Immediate Action: Upgrade to Chainlit version 2.12.0 or later immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Review web server and application logs for suspicious POST requests to the /mcp endpoint, particularly those containing shell metacharacters such as pipes or semicolons.

Compensating Controls: If patching is delayed, disable the MCP feature by setting features.mcp.enabled to false in the .chainlit/config.toml file and restrict network access to the application via a Web Application Firewall.

Public Exploit Available: Unknown

This is a critical vulnerability that poses an immediate threat to any organization running affected versions of Chainlit. Security teams must prioritize upgrading to version 2.12.0 across all environments to eliminate this exposure.