Originally published at HOL CVE-2026-45018: Chainlit MCP stdio unauthenticated RCE Chainlit 2. 12. 0 (2026-08-25) closes two bugs on /mcp .

Source: [Dev.to](https://dev.to/hol/cve-2026-45018-chainlit-mcp-stdio-unauthenticated-rce-and-sibling-cve-2026-45019-30bp)

Sponsored