CVE-2026-22219

Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.

An attacker obtains any authenticated session to a Chainlit application—via a legitimate trial account, phishing a registered user, or credential stuffing. They issue a crafted POST to the /project/element endpoint with a url field set to http://169.254.169.254/latest/meta-data/iam/security-credentials/my-role. The Chainlit server, running on an EC2 instance with an attached IAM role, fetches this URL server-side and stores the JSON response—containing a live AccessKeyId, SecretAccessKey, and SessionToken—into the configured S3 bucket. The attacker retrieves the object from storage and uses the credentials to authenticate to AWS. With the IAM role's permissions (commonly broad in AI development environments), they enumerate S3 buckets containing training data and model weights, access internal model APIs, or establish persistence via new IAM users. The entire attack chain requires only authenticated HTTP access and standard tooling.