GHSA-f3q6-69f3-vwch

Suggest an improvement
Source
https://github.com/advisories/GHSA-f3q6-69f3-vwch
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f3q6-69f3-vwch/GHSA-f3q6-69f3-vwch.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f3q6-69f3-vwch
Aliases
Published
2026-04-20T06:31:28Z
Modified
2026-07-13T16:43:38Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
FastChat has a Content Moderation Bypass via Arena Side-by-Side Views
Details

A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but three other files were missed.

Database specific 
{
    "cwe_ids":  [
        "CWE-670"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-23T14:29:57Z",
    "nvd_published_at":  "2026-04-20T06:16:21Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / fschat

Package

Name
fschat
View open source insights on deps.dev
Purl
pkg:pypi/fschat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.2.36

Affected versions

0.*
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.2.20
0.2.21
0.2.23
0.2.24
0.2.26
0.2.27
0.2.28
0.2.29
0.2.30
0.2.31
0.2.32
0.2.33
0.2.34
0.2.35
0.2.36

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f3q6-69f3-vwch/GHSA-f3q6-69f3-vwch.json"