PYSEC-2026-2485
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/fschat/PYSEC-2026-2485.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2485
- Aliases
- Published
- 2026-07-13T15:02:51.909847Z
- Modified
- 2026-07-13T16:32:37.400687016Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- FastChat has a Content Moderation Bypass via Arena Side-by-Side Views
- Details
-
A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function addtext of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was fixed in commit 34eca62 for gradioblockarenanamed.py, but three other files were missed.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2026-6608
- https://github.com/lm-sys/FastChat/issues/3834
- https://gist.github.com/YLChen-007/e45039d23e698222d887ee09735d9d36
- https://github.com/lm-sys/FastChat
- https://vuldb.com/submit/792228
- https://vuldb.com/vuln/358243
- https://vuldb.com/vuln/358243/cti
- https://pypi.org/project/fschat
- https://github.com/advisories/GHSA-f3q6-69f3-vwch
Affected packages
PyPI / fschat
Package
- Name
- fschat
- View open source insights on deps.dev
- Purl
- pkg:pypi/fschat
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedLast affected0.2.36
Affected versions
0.*
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.2.20
0.2.21
0.2.23
0.2.24
0.2.26
0.2.27
0.2.28
0.2.29
0.2.30
0.2.31
0.2.32
0.2.33
0.2.34
0.2.35
0.2.36