Chainlit: a semicolon in an MCP URL escapes the allowlist's path scope

01What happened

VulnCheck published CVE-2026-120492 on November 2, 2026, a server-side request forgery flaw in Chainlit 2.12.0, and credits Gavin Blacklock with the finding. The flaw defeats the path-scoped allowed_urls allowlist that Chainlit added in version 2.12.0 to close an earlier MCP request forgery issue, CVE-2026-45019.

02How it works

Chainlit's validate_mcp_url function rejects dot segments, encoded separators, backslashes and non-ASCII characters in an MCP URL's path, then matches the path against the operator's allowlist entry as a prefix. The semicolon is not on that reject list, so a path segment written as "..;" is not read as a traversal segment and passes validation. VulnCheck reports that origins which strip semicolon path parameters then treat the segment as "..", which walks above the granted subtree. The request goes to the /mcp endpoint and needs no authentication.

03Who is affected

Chainlit 2.12.0 is the only version VulnCheck lists as affected, and the project's GitHub releases page shows 2.12.0 as its latest release. Reaching the flaw needs an operator to enable the MCP feature, allow user-provided MCP servers and set a path-scoped allowed_urls entry, none of which are Chainlit defaults. Whether the bypass resolves also depends on the target origin treating a semicolon as a path parameter separator.

04What to do

Grant only hosts you would allow in full, because the host, scheme and port checks still hold while the path scope does not. Set features.mcp.enabled = false where the MCP feature is not needed, require authentication on the /mcp endpoint so anonymous callers cannot reach it, and restrict outbound network egress from the Chainlit host, as the project's earlier advisory recommends.

Questions people ask

Is Chainlit patched against CVE-2026-120492?

Chainlit has no fixed release for CVE-2026-120492 as of November 2, 2026. VulnCheck lists 2.12.0 as affected and states no fixed version, and the project's GitHub releases page shows 2.12.0 as the latest version. Operators should disable the MCP feature where it is not needed, require authentication on the /mcp endpoint, and limit outbound network access from the Chainlit host.

Which Chainlit configurations are exposed to the MCP allowlist bypass?

Exposure requires an operator to enable Chainlit's MCP feature, allow user-provided MCP servers, and list at least one allowed_urls entry scoped to a path rather than a whole host. Chainlit ships with MCP disabled and the allowlist denying everything, so default installations are not affected. The bypass also needs the target origin to strip semicolon path parameters.

How does CVE-2026-120492 differ from Chainlit's earlier MCP request forgery flaw?

CVE-2026-45019, published in August 2026, let an unauthenticated caller send Chainlit to any URL at all, and was fixed in 2.12.0 by an opt-in allowlist. CVE-2026-120492 attacks that fix rather than replacing it: host, scheme and port matching still hold, but a semicolon segment escapes the path scope an operator granted. VulnCheck rates the newer flaw medium, at CVSS 6.3.

Sources 4 links, all fetched

1. 1vulncheck.comVulnCheck Advisory
2. 2github.comGitHub Advisory
3. 3github.comChainlit 2.12.0 Fix
4. 4github.comValidation Code