Chainlit AI Framework Flaws Enable Data Theft via File Read and SSRF Bugs

Chainlit, a popular open-source AI framework, has two high-severity flaws—collectively dubbed ChainLeak—that could enable data theft and internal network access, according to Zafran Security.

The vulnerabilities include CVE-2026-22218, an arbitrary file read flaw in the /project/element update flow that lets an authenticated attacker access files readable by the service, and CVE-2026-22219, an SSRF flaw in the same update flow when using the SQLAlchemy data layer that permits arbitrary HTTP requests from the Chainlit server to internal services or cloud metadata endpoints.

The bugs can be chained to leak sensitive data, escalate privileges, and move laterally within a compromised environment, with potential reads of files such as /proc/self/environ to reveal API keys and credentials, or leakage of database files if using SQLite. Following responsible disclosure on 23 November 2025, Chainlit addressed the issues in version 2.9.4, released on 24 December 2025.

The framework has seen substantial usage, with over 220,000 downloads in the past week and 7.3 million downloads to date, underscoring the impact of such flaws on AI-powered systems.