PT-2026-6482 · Pypi · Chainlit

Publicado 2026-01-14 · Atualizado 2026-01-14

OSV

CVSS v3.1

4.2

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

GHSA-V492-6XX2-P57G

Produtos afetados

Chainlit

Referências · 8

• https://github.com/Chainlit/chainlit/releases · Nota
• https://github.com/Chainlit/chainlit · Nota
• https://github.com/Chainlit/chainlit/pull/2637 · Nota
• https://github.com/Chainlit/chainlit/releases/tag/2.8.5 · Nota
• https://github.com/Chainlit/chainlit/commit/8f1153db439eca58ae5c50c8276ba6fdd311448e · Nota
• https://jvn.jp/en/jp/JVN34964581 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-68492 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-v492-6xx2-p57g · Aviso do Fabricante