Skip to main content

Fastchat EUVD-2026-23780

| CVE-2026-6608 MEDIUM
Always-Incorrect Control Flow Implementation (CWE-670)
2026-04-20 VulDB GHSA-f3q6-69f3-vwch
Information Disclosure Fastchat
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
PoC Detected
Apr 22, 2026 - 20:22 vuln.today
Public exploit code
Analysis Generated
Apr 20, 2026 - 06:28 vuln.today
CVSS changed
Apr 20, 2026 - 06:22 NVD
5.3 (MEDIUM) 5.5 (MEDIUM)
EUVD ID Assigned
Apr 20, 2026 - 06:15 euvd
EUVD-2026-23780
Analysis Generated
Apr 20, 2026 - 06:15 vuln.today
CVE Published
Apr 20, 2026 - 05:15 nvd
MEDIUM 5.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 32 pypi packages depend on fschat (26 direct, 6 indirect)

Ecosystem-wide dependent count for version 0.2.36.

DescriptionCVE.org

A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but three other files were missed.

AnalysisAI

Information disclosure in lm-sys FastChat up to version 0.2.36 allows remote unauthenticated attackers to manipulate the add_text function in the Arena Side-by-Side View Handler, resulting in incorrect control flow that exposes sensitive data. The vulnerability has publicly available exploit code and affects the web-based arena comparison interface. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send HTTP request to arena endpoint
Delivery
Craft input triggering control flow mismatch
Exploit
Manipulate add_text function execution
Execution
Redirect data flow to expose model responses
Impact
Exfiltrate comparison metadata or session information
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Remote unauthenticated access to a FastChat instance with the Arena Side-by-Side View Handler component enabled and accessible over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 5.5 with AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated access with no special user interaction required against default configurations, but the scope remains unchanged (SI:L only). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a crafted request to the FastChat arena endpoint, manipulating the add_text function with specially-formatted input that exploits the control flow vulnerability. The incorrect execution path leaks information about competing model responses, comparison metadata, or session data that should have been isolated. …
Remediation Immediate action: Apply the upstream fix from commit 34eca62 (https://github.com/lm-sys/FastChat/issues/3834) to gradio_block_arena_named.py, then identify and patch the three remaining affected files mentioned in the CVE description by cross-referencing the FastChat repository issue tracker. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

EUVD-2026-23780 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy