Fastchat CVE-2026-6608

Remote unauthenticated access to a FastChat instance with the Arena Side-by-Side View Handler component enabled and accessible over the network. The vulnerability requires that the add_text function processes user-controlled input without proper validation - this occurs on any default FastChat arena deployment where the web interface accepts user queries for model comparison. No special authentication, user interaction beyond sending a network request, or non-default configuration is required. Exploitation is limited to environments where the arena interface is exposed to the attacker (internal network, public internet, or authenticated perimeter). The vulnerability does not affect standalone FastChat API endpoints or model serving without the arena comparison feature. Organizations running older FastChat versions (up to 0.2.36) without manual backporting of commit 34eca62 are at full risk; partial application of fixes to only gradio_block_arena_named.py leaves three additional code paths vulnerable.

CVSS 5.5 with AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated access with no special user interaction required against default configurations, but the scope remains unchanged (SI:L only). This moderate score is consistent with information disclosure rather than system-wide compromise. The CVSS vector shows E:P (exploit proof-of-concept exists), confirmed by publicly available exploit code on GitHub Gist. The low integrity impact (VI:L) aligns with the stated information disclosure class rather than data modification. Real-world risk is elevated because: (1) no patch version is confirmed as released - only a partial upstream commit exists; (2) three files remain unpatched despite the identified fix; (3) FastChat is widely deployed in research and production LLM evaluation environments where arena data sensitivity is high. The lack of patched version releases and incomplete fix application elevates practical risk beyond the moderate CVSS score. Defenders cannot rely on a simple version upgrade; they must assess which specific files in their deployment contain the vulnerable code.

An attacker sends a crafted request to the FastChat arena endpoint, manipulating the add_text function with specially-formatted input that exploits the control flow vulnerability. The incorrect execution path leaks information about competing model responses, comparison metadata, or session data that should have been isolated. The attacker can repeat this process against multiple arena sessions to exfiltrate comprehensive model comparison information without authentication, potentially revealing proprietary evaluation results or model performance characteristics.