Arbitrary file access and SSRF vulnerabilities in Chainlit AI framework
Two high-severity vulnerabilities in Chainlit, a popular open source framework for conversational AI, allow authenticated users to read arbitrary files and enable server-side request forgery attacks. The flaws could expose API keys, user data, and cloud resources to attackers.
What happened
Zafran Research disclosed two high-severity vulnerabilities in Chainlit, an open source framework for creating conversational chatbots. The vulnerabilities, tracked as CVE-2026-22218 and CVE-2026-22219, stem from insufficient validation of user-controlled properties in backend services.
The first vulnerability allows authenticated users to read arbitrary files from a Chainlit server by manipulating how custom elements are handled. The second vulnerability enables server-side request forgery (SSRF) in deployments using a SQLAlchemy data layer, allowing an attacker to instruct the server to fetch data from arbitrary URLs and store the response.
Reported impact
According to Zafran, these vulnerabilities can be combined to escalate attacks beyond the application layer. Attackers may gain access to environment variables, local databases and cached user prompts and responses. In cloud-connected deployments, credentials stored in environment variables may allow access to storage services, databases, internal resources and cloud metadata services.
Potential consequences include exposure of API keys, authentication secrets and internal configuration data; leakage of user conversations, prompts and application metadata; and access to cloud resources allowing possible lateral movement within an account.
Index analysis
The vulnerabilities represent traditional web application flaws rather than AI-specific threats. Zafran noted that while discussions of AI security often focus on prompt injection or model misuse, these vulnerabilities expose how weaknesses in backend infrastructure can affect AI-driven systems regardless of the underlying AI models.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.