Chainlit at a glance
Two flaws in Chainlit before 2.9.4 let any logged-in user read files from the server or make it fetch internal URLs, including cloud metadata. Zafran Labs disclosed them as ChainLeak. Upgrade to 2.9.4.
Chainlit: status
- Affected
- Chainlit versions before 2.9.4 (CVE-2026-22218)
- Chainlit versions before 2.9.4 using the SQLAlchemy data layer (CVE-2026-22219)
- Status as of
- Discovered by
- Gal Zaban and Ido Shani, Zafran Labs
What changed with Chainlit
On January 20, 2026, CVE-2026-22218 and CVE-2026-22219 were published for Chainlit, an open-source Python framework for building chat interfaces on top of LLM apps. Both live in the /project/element update flow and affect versions before 2.9.4. Zafran Labs researchers, who found them, call the pair ChainLeak.
CVE-2026-22218 (NVD 6.5, medium) lets an authenticated user submit a custom element with a file path, so the server copies any file it can read into the attacker's session for download. CVE-2026-22219 (NVD 7.7, high) is a server-side request forgery in deployments using the SQLAlchemy data layer: the server fetches an attacker-chosen URL, such as an internal service or cloud metadata endpoint, and stores the response.
Zafran reports that the file read can expose environment variables with API keys, the auth secret used to sign Chainlit sessions, source code, and cached prompts, and that on AWS instances still allowing IMDSv1 the SSRF can return IAM role credentials. Chainlit 2.9.4, released in December 2025, adds sanitization for custom element updates.
How to fix it: Chainlit
Advisories
- NVD CVE-2026-22218 (opens in a new tab)nvd.nist.gov
- NVD CVE-2026-22219 (opens in a new tab)nvd.nist.gov
- Chainlit 2.9.4 release notes (opens in a new tab)github.com
Where to compare Chainlit
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why Chainlit matters for businesses
Chainlit often fronts internal assistants and customer chatbots where any signed-up user counts as authenticated. A leaked auth secret or cloud credential turns one chat account into access to other users' sessions and the wider cloud account, so upgrade and enforce IMDSv2 on AWS hosts.
Sources for this story
- CVE-2026-22218 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- CVE-2026-22219 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- Chainlit 2.9.4 release (opens in a new tab)Official
Chainlit on GitHub · github.com
- ChainLeak: Critical AI framework vulnerabilities expose data, enable cloud takeover (opens in a new tab)Press
Zafran · zafran.io
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #chainlit
- #ssrf
- #chat-interfaces
- #cloud-security