Vulnerability · Published Jan 19, 2026 · Assigned by VulnCheck

CVE-2026-22219Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element

High 8.3

In plain English

A high-severity server-side request forgery in Chainlit from Chainlit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.2% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)5.2%top 7.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	chainlit	2.9.4	GHSA-2g59-m95p-pgfq
PyPI	chainlit	2.9.4	PYSEC-2026-1237

Affected products (as reported)

Vendor	Product	Versions
Chainlit	Chainlit	0 – before 2.9.4

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

https://github.com/Chainlit/chainlit/releases/tag/2.9.4 release-notes, patch
https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover technical-description, exploit
https://www.vulncheck.com/advisories/chainlit-sqlalchemy-data-layer-ssrf-via-project-element third-party-advisory