Chainlit Vulnerabilities May Leak Sensitive Information

Two high-severity vulnerabilities in Chainlit can be exploited without user interaction to leak sensitive information, according to Zafran. Chainlit versions prior to 2.9.4 are affected by CVE-2026-22218 and CVE-2026-22219, which allow threat actors to read arbitrary files and make requests to internal network services or cloud metadata endpoints.

The flaws permit exfiltration of environment variables that may contain API keys, credentials, internal file paths, internal IPs and ports, and even the CHAINLIT_AUTH_SECRET used to sign authentication tokens, thereby enabling token forging and potential account takeovers.

If deployments rely on an SQLAlchemy data layer with an SQLite backend, the Chainlit database containing users, conversations, messages and metadata can be leaked, and in LangChain integrations attackers could access prompts and responses stored in the LangChain cache or retrieve application source code from the Chainlit directory.

Zafran notes that AWS-hosted instances could be targeted to retrieve role endpoints and move laterally within cloud environments, risking access to storage buckets, secret managers and other cloud resources. Written by Ionut Arghire, the article appeared on 20 January 2026. according to Zafran.