What happened
Chainlit's MCP endpoint validation lets an attacker bypass path-scoped allowed_urls entries by embedding '..;' segments, enabling SSRF to paths the operator never granted. Published 2026-11-02 with a GitHub Security Advisory and a VulnCheck advisory; it is a medium-severity (CVSS 3.1 5.4 / CVSS 4.0 6.3) server-side request forgery in the framework's native Model Context Protocol surface.
Why it matters
Chainlit is a widely-used open-source framework for building LLM/chatbot applications and exposes an MCP endpoint that agents and users call. Bypassing the path-scoped MCP allowlist turns the framework's own MCP server into an arbitrary-request primitive, letting attackers reach internal metadata, admin paths or adjacent services the operator thought were cut off.
Attack vector
An unauthenticated attacker submits an MCP URL containing '..;' path segments to the /mcp endpoint. Chainlit's validate_mcp_url does not reject the semicolon character, so a URL whose path-scoped prefix passes the allowed_urls grant can resolve (on origins that strip semicolon path parameters) to a path outside the operator's authorization, producing a server-side request forgery.
Affected systems
Chainlit 2.12.0 (broader range per GHSA-hvfh-5mj3-5f3j); validate_mcp_url in backend/chainlit/mcp.py
Mitigation
Upgrade Chainlit to the patched version referenced by GHSA-hvfh-5mj3-5f3j / the VulnCheck advisory; reject semicolon characters in validate_mcp_url and confine MCP URLs to the allowed path scope; ensure the backend origin actually strips semicolon path parameters.