CVE-2026-86099

Chainlit through version 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to inject absolute paths or relative path sequences such as '../' into network requests. Because this unsanitized value drives filesystem operations without being confined to the upload directory, a crafted sessionId lets the attacker traverse outside the intended path. The impact is a recursive deletion of arbitrary directories accessible to the service process, producing data loss and downtime — reflected in the CVSS 4.0 vector's high availability impact, low integrity impact, and no confidentiality impact. Any deployment of Chainlit up to and including 2.12.0 whose socket.io interface is reachable by untrusted clients is affected. As of this analysis there is no known public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation.

What to do: Upgrade Chainlit to the latest patched release beyond 2.12.0 as soon as one is published, and check your current version (e.g., via pip show chainlit). Until patched, mitigate by validating or constraining the socket.io sessionId parameter at an ingress proxy and running the Chainlit service under an account with minimal filesystem write permissions so deletions cannot reach critical directories. Also verify that no unexpected directory deletions have already occurred and limit unauthenticated internet exposure of Chainlit instances.