GHSA-c39v-8hrw-h448

Suggest an improvement
Source
https://github.com/advisories/GHSA-c39v-8hrw-h448
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c39v-8hrw-h448/GHSA-c39v-8hrw-h448.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c39v-8hrw-h448
Aliases
Published
2026-06-22T18:34:16Z
Modified
2026-09-21T22:30:12Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Chainlit contains a session hijacking vulnerability
Details

Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.

Database specific 
{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-21T22:21:35Z",
    "nvd_published_at":  "2026-06-22T16:16:40Z",
    "severity":  "CRITICAL"
}
References

Affected packages

PyPI / chainlit

Package

Name
chainlit
View open source insights on deps.dev
Purl
pkg:pypi/chainlit

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.10.1

Affected versions

0.*
0.1.0
0.1.1
0.1.101
0.1.102
0.1.103
0.2.0
0.2.1
0.2.101
0.2.102
0.2.103
0.2.104
0.2.105
0.2.106
0.2.107
0.2.108
0.2.109
0.2.110
0.2.111
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.101
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.401
0.6.402
0.7.0
0.7.1
0.7.2
0.7.3
0.7.301
0.7.400
0.7.500
0.7.501
0.7.600rc0
0.7.600rc1
0.7.601rc0
0.7.602rc0
0.7.602
0.7.603
0.7.604rc0
0.7.604rc1
0.7.604rc2
0.7.604
0.7.700
1.*
1.0.0rc0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.0.0
1.0.100
1.0.101
1.0.200
1.0.300
1.0.301
1.0.400
1.0.401
1.0.500
1.0.501
1.0.502
1.0.503
1.0.504
1.0.505
1.0.506
1.1.0rc0
1.1.0rc1
1.1.0
1.1.101
1.1.200
1.1.201
1.1.202
1.1.300rc0
1.1.300rc1
1.1.300rc2
1.1.300rc3
1.1.300rc4
1.1.300rc5
1.1.300
1.1.301
1.1.302
1.1.303
1.1.304
1.1.305
1.1.306
1.1.400rc0
1.1.400rc1
1.1.400
1.1.401
1.1.402
1.1.403rc0
1.1.404
1.2.0rc0
1.2.0
1.3.0rc0
1.3.0rc1
1.3.0
1.3.1
1.3.2
2.*
2.0.dev0
2.0.dev1
2.0.dev2
2.0rc0
2.0rc1
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.601
2.0.602
2.0.603
2.1.0
2.1.1
2.1.2
2.2.0
2.2.1
2.3.0
2.4.0rc0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.201
2.4.301
2.4.302
2.4.400
2.5.5
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.1
2.7.1.1
2.7.2
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.10.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c39v-8hrw-h448/GHSA-c39v-8hrw-h448.json"