Chainlit contain a server-side request forgery (SSRF) vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-22219 · ADVISORY
• Chainlit/chainlit commit ffc3cce · WEB
• Chainlit/chainlit · PACKAGE
• Chainlit/chainlit release 2.9.4 · WEB
• vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element · WEB
• zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover · WEB
• pypi.org/project/chainlit · PACKAGE
• GitHub Advisory GHSA-2g59-m95p-pgfq · ADVISORY

chainlit のその他の脆弱性

• CVE-2026-45019高 7.2Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployment…
• CVE-2026-45018緊急 9.8Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployment…
• CVE-2026-56104高 8.2Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated…
• CVE-2026-22218中 6.5Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client c…
• CVE-2025-68492低 2.3Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploit…