# Chainlit: a semicolon in an MCP URL escapes the allowlist's path scope

> Chainlit 2.12.0 lets unauthenticated requests reach paths outside the operator's MCP allowlist, because its URL check ignores semicolons.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-11-02
- **CVE:** CVE-2026-120492
- **CVSS:** 6.3
- **Affects:** Chainlit
- **Research by:** Gavin Blacklock
- **Primary source:** https://www.vulncheck.com/advisories/chainlit-2.12.0-ssrf-via-semicolon-path-segment-in-mcp-allowed-urls
- **Page:** https://theinjection.dev/items/vulncheck-chainlit-mcp-allowlist-semicolon-bypass/

Chainlit 2.12.0 does not reject semicolons when it checks an MCP URL against its allowlist, so a "..;" segment reaches paths the operator never granted. VulnCheck published CVE-2026-120492 on November 2 and lists no fixed version.

## What happened

VulnCheck published CVE-2026-120492 on November 2, 2026, a server-side request forgery flaw in Chainlit 2.12.0, and credits Gavin Blacklock with the finding. The flaw defeats the path-scoped allowed_urls allowlist that Chainlit added in version 2.12.0 to close an earlier MCP request forgery issue, CVE-2026-45019.

## How it works

Chainlit's validate_mcp_url function rejects dot segments, encoded separators, backslashes and non-ASCII characters in an MCP URL's path, then matches the path against the operator's allowlist entry as a prefix. The semicolon is not on that reject list, so a path segment written as "..;" is not read as a traversal segment and passes validation. VulnCheck reports that origins which strip semicolon path parameters then treat the segment as "..", which walks above the granted subtree. The request goes to the /mcp endpoint and needs no authentication.

## Who is affected

Chainlit 2.12.0 is the only version VulnCheck lists as affected, and the project's GitHub releases page shows 2.12.0 as its latest release. Reaching the flaw needs an operator to enable the MCP feature, allow user-provided MCP servers and set a path-scoped allowed_urls entry, none of which are Chainlit defaults. Whether the bypass resolves also depends on the target origin treating a semicolon as a path parameter separator.

## What to do

Grant only hosts you would allow in full, because the host, scheme and port checks still hold while the path scope does not. Set features.mcp.enabled = false where the MCP feature is not needed, require authentication on the /mcp endpoint so anonymous callers cannot reach it, and restrict outbound network egress from the Chainlit host, as the project's earlier advisory recommends.

## Quick facts

- **Affected:** Chainlit 2.12.0
- **Fixed in:** No fixed version listed; 2.12.0 is the latest release
- **CVE:** CVE-2026-120492, assigned by VulnCheck
- **Found by:** Gavin Blacklock, per VulnCheck
- **Disclosed:** November 2, 2026
- **Attack type:** Unauthenticated server-side request forgery via an allowlist path bypass
- **Precondition:** MCP enabled, user servers allowed, and a path-scoped allowed_urls entry

## Questions

### Is Chainlit patched against CVE-2026-120492?

Chainlit has no fixed release for CVE-2026-120492 as of November 2, 2026. VulnCheck lists 2.12.0 as affected and states no fixed version, and the project's GitHub releases page shows 2.12.0 as the latest version. Operators should disable the MCP feature where it is not needed, require authentication on the /mcp endpoint, and limit outbound network access from the Chainlit host.

### Which Chainlit configurations are exposed to the MCP allowlist bypass?

Exposure requires an operator to enable Chainlit's MCP feature, allow user-provided MCP servers, and list at least one allowed_urls entry scoped to a path rather than a whole host. Chainlit ships with MCP disabled and the allowlist denying everything, so default installations are not affected. The bypass also needs the target origin to strip semicolon path parameters.

### How does CVE-2026-120492 differ from Chainlit's earlier MCP request forgery flaw?

CVE-2026-45019, published in August 2026, let an unauthenticated caller send Chainlit to any URL at all, and was fixed in 2.12.0 by an opt-in allowlist. CVE-2026-120492 attacks that fix rather than replacing it: host, scheme and port matching still hold, but a semicolon segment escapes the path scope an operator granted. VulnCheck rates the newer flaw medium, at CVSS 6.3.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/chainlit-2.12.0-ssrf-via-semicolon-path-segment-in-mcp-allowed-urls)
2. [GitHub Advisory](https://github.com/advisories/GHSA-xhx7-9vjr-p2h8)
3. [Chainlit 2.12.0 Fix](https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j)
4. [Validation Code](https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L199-L208)