CVE-2023-29159

Advisory

Chainlit 1.0.501 has updated its Starlette dependency to version "^0.37.2" from "<0.33.0" to address the security issue identified in CVE-2023-29159.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Added

- Messages and steps now accept tags and metadata (useful for the data layer)

Changed

- The LLama Index callback handler should now show retrieved chunks in the intermadiary steps
- Renamed the Literal environment variable to `LITERAL_API_URL` (it used to be `LITERAL_SERVER`)

Fixed

- Starting a new conversation should close the element side bar
- Resolved security issues by upgrading starlette dependency

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29159
• https://github.com/Chainlit/chainlit/commit/2a650dcd7f3eca74dd666422df3fa2a29e170912#diff-9f2cf60079756e94b31dbaeb145297215236d3c0135647163c2e51b80fd81551