Chainlit Security Flaws Highlight Infrastructure Risks in AI Apps

Two vulnerabilities in the Chainlit conversational AI framework (CVE-2026-22218 and CVE-2026-22219) enable authenticated arbitrary file read and SSRF by abusing custom element handling and SQLAlchemy-backed data flows, potentially exposing API keys, user conversations, environment variables and cloud resources; vulnerabilities were found by Zafran Research, a patch (Chainlit 2.9.4) was released on 24 Dec 2025, and temporary WAF signatures were published to mitigate risk until updates are applied.