CVE-2026-86099
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
Слабость
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
Источники
- https://github.com/Chainlit/chainlit
- https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/session.py
- https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/socket.py
- https://pypi.org/project/chainlit/
- https://www.vulncheck.com/advisories/chainlit-through-2.12.0-path-traversal-via-socket-io-sessionid
Найдите уязвимость раньше атакующего.
Войдите через GitHub и запустите первый аудит меньше чем за минуту. Для бесплатного тарифа банковская карта не нужна.