8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22219

CVE-2026-22219: Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element

Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22219

CVE-2026-22219:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chainlit	pip	< 2.9.4	2.9.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a Server-Side Request Forgery (SSRF) within the Chainlit application, specifically in the /project/element update functionality when using the SQLAlchemy data layer. The root cause of the vulnerability lies in the improper handling of user-supplied data within the update_thread_element and delete_thread_element functions in backend/chainlit/server.py.

Analysis of the patch commit ffc3cce648b343b933e10e85ee5805c7e02ab3bf reveals that both of these functions were modified to sanitize the incoming element data from the user. Prior to the patch, these functions would create Element or CustomElement objects directly from a user-controlled dictionary. This allowed an authenticated attacker to provide a specially crafted url field within the element data.

In the update_thread_element function, the call to element.update() would then cause the server to make an HTTP GET request to the attacker-supplied URL. This is the primary vector for the SSRF vulnerability.

The delete_thread_element function was also patched, indicating that it was also considered a potential vector. It was creating a CustomElement with the user-provided URL, which could have been exploited in a similar manner.

The fix involves the introduction of a new helper function, _sanitize_custom_element. This function is now used by both update_thread_element and delete_thread_element to create a CustomElement object. Crucially, this sanitizing function intentionally omits the url, object_key, and chainlit_key fields from the user-provided data, thus preventing the SSRF attack by not allowing user-controlled URLs to be processed by the backend.

Vulnerable functions

update_thread_element

backend/chainlit/server.py

This function was vulnerable because it took a user-controlled dictionary `element_dict` and used `Element.from_dict` to create an element. This allowed an attacker to include a malicious 'url' field. The subsequent call to `await element.update()` would trigger a server-side request to the specified URL, leading to an SSRF vulnerability. The patch replaced this line with a call to a sanitizing function `_sanitize_custom_element`.

delete_thread_element

backend/chainlit/server.py

This function was also patched to prevent the creation of a `CustomElement` with a user-controlled URL. Before the patch, it directly instantiated a `CustomElement` using the raw `element_dict` from the user, including the `url` field. While the main exploit path was likely through the update flow, this function also handled unsanitized user input and was therefore a potential security risk that was remediated by the patch.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.