{"id":"CVE-2026-120492","title":"Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls","summary":"Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can sub…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"Chainlit","product":"Chainlit","affected":["Chainlit 2.12.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-07T00:22:32.709220Z"},"exploitAvailable":true,"published":"2026-11-02","updated":"2026-11-07","sourceUpdated":"2026-11-07T00:22:59.156Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120492","references":[{"url":"https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j","label":"GitHub Security Advisory (GHSA-hvfh-5mj3-5f3j)"},{"url":"https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L90-L177"},{"url":"https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L199-L208"},{"url":"https://www.vulncheck.com/advisories/chainlit-2.12.0-ssrf-via-semicolon-path-segment-in-mcp-allowed-urls","label":"VulnCheck Advisory: Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls"},{"url":"https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9"},{"url":"https://github.com/Chainlit/chainlit"},{"url":"https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-002--ssrf-via-mcp-streamable-http--sse"},{"url":"https://github.com/Chainlit/chainlit/releases/tag/2.12.0"},{"url":"https://pypi.org/project/chainlit"},{"url":"https://github.com/advisories/GHSA-hvfh-5mj3-5f3j"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45019"}],"tags":["cve.org","exploit-available","osv","pip"],"epss":0.00221,"epssPercentile":0.12729,"aliases":["GHSA-hvfh-5mj3-5f3j","CVE-2026-45019","PYSEC-2026-3811"],"ecosystem":"pip","patched":["chainlit 2.12.0"],"scores":{"cna":5.4,"osv":7.2},"ingestedAt":"2026-11-03T19:08:53.338Z","slug":"CVE-2026-120492","body":"## Overview\n\nChainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.\n\n## Affected\n\n- `Chainlit 2.12.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-120492)\n\nAffected packages:\n\n- `chainlit >= 2.4.0rc0, < 2.12.0`\n\nPatched in:\n\n- `chainlit 2.12.0`\n\nSource: https://osv.dev/vulnerability/GHSA-hvfh-5mj3-5f3j","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":235710,"id":"CVE-2026-120492","ts":1794013690591,"field":"exploit_available","old":"false","new":"true"},{"seq":235709,"id":"CVE-2026-120492","ts":1794013690591,"field":"cvss","old":"7.2","new":"5.4"},{"seq":235708,"id":"CVE-2026-120492","ts":1794013690591,"field":"severity","old":"high","new":"medium"}]}