github-featured / chainlit--chainlit

发布

0 发布 168 Git 标签

RSS 订阅源
  • 2.12.0 0565fd0ecc
    比较

    Merge commit from fork

    frostbyte_neo 发布于 2026-08-25 16:29:43 +00:00

    • fix(mcp)!: prevent unauthenticated RCE and SSRF via /mcp

    Fixes two vulnerabilities in the /mcp endpoint, both exploitable by an
    unauthenticated attacker whenever features.mcp.enabled = true. Affects
    v2.4.0rc0 through v2.11.x; MCP has been disabled by default since v2.7.0.

    CVE-2026-45018 / SPL-2026-001 — Command injection via the stdio transport
    (CVSS v3.1 9.8, Critical). POST /mcp accepted a client-supplied
    fullCommand, validated only by executable name; npx -c yielded
    arbitrary shell execution before the MCP handshake completed.

    CVE-2026-45019 / SPL-2026-002 — SSRF via the streamable-http and SSE
    transports (CVSS v3.1 7.2, High). POST /mcp accepted arbitrary url
    and headers, allowing outbound requests to internal services and cloud
    metadata endpoints with forged headers.

    The fix for SPL-2026-001 is architectural rather than filtering: no
    argument-level validation can sandbox a command whose full argument list the
    attacker controls. stdio servers are now declared exclusively in server-side
    config and the client sends only a name.

    BREAKING CHANGE: legacy MCP config keys ([features.mcp.sse],
    [features.mcp.stdio], [features.mcp.streamable-http],
    allowed_executables) now abort startup instead of being silently ignored,
    replaced by a unified [[features.mcp.servers]] array and an opt-in
    [features.mcp.user_servers] section. User-provided SSE/HTTP connections
    require explicit enabled = true plus a non-empty allowed_urls, where they
    were previously on by default. MCP connections no longer follow HTTP
    redirects, for developer-configured servers as well as user-provided ones.
    @chainlit/react-client 0.5.0 removes connectStdioMCP(), connectSseMCP()
    and connectStreamableHttpMCP() in favour of connectMcp() for named servers
    and connectUserMcp() for user-provided ones.

    Migration guides for both the config and the client API are in CHANGELOG.md;
    full technical detail, impact analysis and mitigations for deployments that
    cannot upgrade immediately are in docs/security-advisory-2026-mcp.md.

    Reported by Vipin and Stephen at SPL Security (security@spl.team) under
    coordinated disclosure, with working proof-of-concept exploits for both
    issues. We thank them for a thorough and responsibly disclosed report.

    Co-Authored-By: Claude noreply@anthropic.com
    Co-Authored-By: Claude Opus 5 noreply@anthropic.com

    • chore(release): 2.12.0

    Bump the backend to 2.12.0 and @chainlit/react-client to 0.5.0.

    Co-Authored-By: Claude Opus 5 noreply@anthropic.com

    • docs(changelog): 2.12.0 release notes

    Add the 2.12.0 section covering the MCP security fixes, the dependency
    floors, and the MCP config / @chainlit/react-client migration guides.

    Co-Authored-By: Claude Opus 5 noreply@anthropic.com

    Co-authored-by: Claude noreply@anthropic.com

    下载附件