CVE-2026-22219

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-22219

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

C

hainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.

References
Link Resource
https://github.com/Chainlit/chainlit/releases/tag/2.9.4 Product Release Notes
https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element Third Party Advisory
https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover Exploit Mitigation Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:chainlit:chainlit:*:*:*:*:*:*:*:*
History

02 Feb 2026, 20:56

Type Values Removed Values Added
First Time Chainlit chainlit
Chainlit
CPE cpe:2.3:a:chainlit:chainlit:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.7
References () https://github.com/Chainlit/chainlit/releases/tag/2.9.4 - () https://github.com/Chainlit/chainlit/releases/tag/2.9.4 - Product, Release Notes
References () https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element - () https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element - Third Party Advisory
References () https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover - () https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover - Exploit, Mitigation, Third Party Advisory

20 Jan 2026, 19:15

Type Values Removed Values Added
References
  • () https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover -

20 Jan 2026, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-20 00:15

Updated : 2026-02-02 20:56

NVD link : CVE-2026-22219

Mitre link : CVE-2026-22219

CVE.ORG link : CVE-2026-22219

JSON object : View

Products Affected

chainlit

CWE
CWE-918

Server-Side Request Forgery (SSRF)