Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected?

Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session.

Summary

When MCP is enabled (features.mcp.enabled = true), the POST /mcp endpoint for stdio transport accepts a user-controlled fullCommand string. The validate_mcp_command() function checks the executable name against a configurable allowlist but does not inspect or restrict the arguments. An attacker can pass npx -y -c 'ARBITRARY COMMAND' to execute arbitrary shell commands on the server with the privileges of the Chainlit process.

Affected / patched versions

The server runs the command before the MCP handshake fails. The output of id is written to /tmp/rce_proof.

### Impact

**Critical.** An unauthenticated remote attacker can execute arbitrary OS commands on the server with the privileges of the Chainlit process. This can lead to full host compromise, data exfiltration, lateral movement, and installation of persistent backdoors. Any Chainlit deployment with MCP enabled is affected.

### Fix

Chainlit 2.12.0 removes `fullCommand` from the client request entirely. stdio MCP servers are now declared by the developer in `.chainlit/config.toml` under `[[features.mcp.servers]]` and selected by name at connection time; the command string never crosses the trust boundary from client to server, so there is no command left to sanitize and no `allowed_executables` mechanism anymore. Per-server environment variables are configured via an `env` mapping on the server entry rather than supplied by the client.

### Workarounds

If you cannot upgrade immediately:

- Set `features.mcp.enabled = false` in `.chainlit/config.toml`. This fully prevents exploitation of this issue (and of the companion SSRF issue, CVE-2026-45019).
- Restrict outbound process-spawning / network capability from the host running Chainlit.
- Configure authentication (register an auth callback) so that `/mcp` requires an authenticated session. This does not fix the underlying command injection, but removes the unauthenticated attack path.

### Upgrading to 2.12.0

> **Breaking change.** 2.12.0 changes how MCP servers are configured. If `.chainlit/config.toml` still uses the legacy `[features.mcp.sse]`, `[features.mcp.stdio]`, or `[features.mcp.streamable-http]` sections, or the `allowed_executables` setting, the application will fail to start **once MCP is enabled**, until you migrate to the new `[[features.mcp.servers]]` configuration. See the migration guide in `CHANGELOG.md` before upgrading. Deployments with `features.mcp.enabled = false` are not affected by this startup check.

### Residual risk after upgrading

- On deployments with no authentication configured, `/mcp` remains reachable anonymously after upgrading, because `get_current_user` returns `None` when no auth callback is registered. An anonymous client can therefore still cause **developer-configured** stdio servers to be spawned by name. Because the command itself is developer-controlled rather than attacker-supplied, this is no longer remote code execution — but it is still unauthenticated process spawning on deployments without authentication.
- No resource limits are placed on stdio server spawning, and there is no cap on concurrent MCP sessions per client.

### Credits

Vipin 
SPL