Executive brief
Chainlit is a framework for building AI chat applications. When its Model Context Protocol (MCP) feature is enabled, an attacker can bypass command validation by injecting shell arguments into the stdio transport endpoint, achieving unauthenticated remote code execution with the privileges of the Chainlit process. Most deployments are unaffected because MCP is disabled by default.
Technical details
The vulnerability is an OS command injection flaw in the `validate_mcp_command()` function in `backend/chainlit/mcp.py`. The function uses `shlex.split()` to parse a user-supplied `fullCommand` string and validates only the executable name (e.g., `npx`, `uvx`) against a configurable allowlist (`config.features.mcp.stdio.allowed_executables`), but returns arguments unchecked. These arguments are passed directly to `StdioServerParameters`, which spawns a subprocess. Since tools like `npx` support the `-c` flag for arbitrary shell execution, an attacker can craft a request like `npx -y -c 'id > /tmp/proof'` to pass the allowlist check while executing arbitrary commands. The `/mcp` endpoint is unconditionally registered on the FastAPI router in all Chainlit deployments; exploitation requires only an open session and `features.mcp.enabled = true`. A secondary issue exists in the Pydantic model where `allowed_executables` defaults to `None`, treated as "allow everything." The fix in v2.12.0 removes `fullCommand` from the client API entirely, moving command definition to developer-controlled configuration.
Affected products
- Chainlit Chainlit >=2.4.0rc0, <2.12.0
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Version 2.12.0 released with fix removing fullCommand from client API