Executive brief
Chainlit is an open-source framework used to build conversational AI applications and user interfaces. A security vulnerability exists where an authenticated user can force the server to make unauthorized requests to internal systems or cloud metadata services. This could allow an attacker to access sensitive internal data, leak cloud environment credentials, or interact with private services that are not intended to be exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Chainlit's '/project/element' update flow when the SQLAlchemy data layer backend is enabled. The vulnerability occurs because the SQLAlchemy element creation logic fetches a user-provided URL via an outbound HTTP GET request without sufficient validation. An authenticated attacker can exploit this to perform arbitrary HTTP requests from the Chainlit server, targeting internal network services or cloud provider metadata endpoints (e.g., IMDS). The retrieved responses can then be stored via the configured storage provider, allowing the attacker to exfiltrate sensitive information. The issue is fixed in version 2.9.4 by adding sanitization for custom thread element updates.
Affected products
- Chainlit Chainlit < 2.9.4
Timeline
- 2025-12-25: patched: Version 2.9.4 released
- 2026-01-19: advisory: Initial advisory published by VulnCheck
- 2026-01-20: disclosed: Detailed research published by Zafran Labs