CVE-2026-22219

HighCVSS 7.7/10Last modified Oct 8, 2026

Description

Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy element creation logic using an outbound HTTP GET request. This allows an attacker to make arbitrary HTTP requests from the Chainlit server to internal network services or cloud metadata endpoints and store the retrieved responses via the configured storage provider.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Jan 20, 2026
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-22224.8A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of thCVE-2026-222204.5A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to causCVE-2026-222218.0An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent authenticated attacker eCVE-2026-222228.0An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent authenticated attacCVE-2026-222238.0An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker CVE-2026-222247.2A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link ArchCVE-2026-222257.2A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the Archer BE230 v1.2  CVE-2026-222267.2A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link ArcherCVE-2026-222277.2A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of theCVE-2026-222284.9An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted conCVE-2026-222297.2A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration filCVE-2026-22239.8A security vulnerability has been detected in code-projects Online Reviewer System 1.0. Affected by this issue is some unknown functionality
CVE-2026-22219: High severity, CVSS 7.7 | Vulnix