Chainlit AI framework bugs let hackers breach cloud environments

Two high-severity vulnerabilities in Chainlit, a popular open-source framework for building conversational AI applications, allow reading any file on the server and leaking sensitive information. The issues, dubbed 'ChainLeak' and discovered by Zafran Labs researchers, can be exploited without user interaction and impact "internet-facing AI systems that are actively deployed across multiple industries, including large enterprises." The Chainlit AI app-building framework has an average of 700,000 monthly downloads on the PyPI registry and 5 million downloads per year. It provides a ready-made web UI for chat-based AI parts, backend plumbing tools, and built-in support for authentication, session handling, and cloud deployment. It is typically used in enterprise deployments and academic institutions, and is found in internet-facing production systems. The two security issues that Zafran researchers discovered are an arbitrary file read tracked as CVE-2026-22218, and a server-side request forgery (SSRF) tracked as CVE-2026-22219. CVE-2026-22218 can be exploited via the /project/element endpoint and allows attackers to submit a custom element with a controlled ‘path’ field, forcing Chainlit to copy the file at that path into the attacker’s session without validation. This results in attackers reading any file accessible to the Chainlit server, including sensitive information such as API keys, cloud account credentials, source code, internal configuration files, SQLite databases,...