PYSEC-2026-1397
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/fschat/PYSEC-2026-1397.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1397
- Aliases
-
- CVE-2024-11603
- GHSA-h254-g997-685c
- Published
- 2026-07-07T14:34:52Z
- Modified
- 2026-07-07T17:46:41Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- FastChat Server-Side Request Forgery vulnerability
- Details
-
A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the
/queue/join?endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal networks or the AWS metadata endpoint, potentially exposing sensitive data and compromising internal servers. - References
Affected packages
PyPI / fschat
Package
- Name
- fschat
- View open source insights on deps.dev
- Purl
- pkg:pypi/fschat
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedLast Affected0.2.36
Affected versions
0.*
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.2.20
0.2.21
0.2.23
0.2.24
0.2.26
0.2.27
0.2.28
0.2.29
0.2.30
0.2.31
0.2.32
0.2.33
0.2.34
0.2.35
0.2.36