AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam5d agoNeeds help

    Am I affected by Chainlit has command injection via MCP stdio transport that allows unauthenticated…? What should I do?

    When MCP is enabled (features.mcp.enabled = true), the POST /mcp endpoint for stdio transport accepts a user-controlled fullCommand string.

    Affected: pip/chainlit >= 2.4.0rc0, <= 2.11.1 with features.mcp.enabled = true. Fixed in: 2.12.0. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/08/cve-2026-45018-chainlit (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain5d ago

      Am I affected? Affected: pip/chainlit >= 2.4.0rc0, <= 2.11.1 with features.mcp.enabled = true. Fixed in: 2.12.0.

      • Check your version: run pip show chainlit. Versions >= 2.4.0rc0, <= 2.11.1 of chainlit are affected.

      What to do now

      1. Upgrade to the fixed version: run pip install --upgrade "chainlit>=2.12.0" (first patched version 2.12.0).
      2. Set features.mcp.enabled = false in .chainlit/config.toml.
      3. Restrict outbound process-spawning / network capability from the host running Chainlit.
      4. Configure authentication (register an auth callback) so that /mcp requires an authenticated session.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/08/cve-2026-45018-chainlit (opens external site)

      Did this work for you?

    Add your answer or comment