CVE-2026-6608
Full vulnerability record from the local CVENow database.
Description
A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but three other files were missed.
Severity
MEDIUM
CVSS score
5.5
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-04-20 06:16:21.733000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-6608",
"sourceIdentifier": "[email protected]",
"published": "2026-04-20T06:16:21.733",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but three other files were missed."
},
{
"lang": "es",
"value": "Una vulnerabilidad fue detectada en lm-sys fastchat hasta la versión 0.2.36. La función afectada es add_text del componente Gestor de Vista Lado a Lado de Arena. La manipulación resulta en un flujo de control incorrecto. El ataque puede lanzarse remotamente. El exploit ahora es público y puede ser utilizado. La causa raíz fue corregida en el commit 34eca62 para gradio_block_arena_named.py, pero se pasaron por alto otros tres archivos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "lm-sys",
"product": "fastchat",
"cpes": [
"cpe:2.3:a:lm-sys:fastchat:*:*:*:*:*:*:*:*"
],
"modules": [
"Arena Side-by-Side View Handler"
],
"versions": [
{
"version": "0.2.0",
"status": "affected"
},
{
"version": "0.2.1",
"status": "affected"
},
{
"version": "0.2.2",
"status": "affected"
},
{
"version": "0.2.3",
"status": "affected"
},
{
"version": "0.2.4",
"status": "affected"
},
{
"version": "0.2.5",
"status": "affected"
},
{
"version": "0.2.6",
"status": "affected"
},
{
"version": "0.2.7",
"status": "affected"
},
{
"version": "0.2.8",
"status": "affected"
},
{
"version": "0.2.9",
"status": "affected"
},
{
"version": "0.2.10",
"status": "affected"
},
{
"version": "0.2.11",
"status": "affected"
},
{
"version": "0.2.12",
"status": "affected"
},
{
"version": "0.2.13",
"status": "affected"
},
{
"version": "0.2.14",
"status": "affected"
},
{
"version": "0.2.15",
"status": "affected"
},
{
"version": "0.2.16",
"status": "affected"
},
{
"version": "0.2.17",
"status": "affected"
},
{
"version": "0.2.18",
"status": "affected"
},
{
"version": "0.2.19",
"status": "affected"
},
{
"version": "0.2.20",
"status": "affected"
},
{
"version": "0.2.21",
"status": "affected"
},
{
"version": "0.2.22",
"status": "affected"
},
{
"version": "0.2.23",
"status": "affected"
},
{
"version": "0.2.24",
"status": "affected"
},
{
"version": "0.2.25",
"status": "affected"
},
{
"version": "0.2.26",
"status": "affected"
},
{
"version": "0.2.27",
"status": "affected"
},
{
"version": "0.2.28",
"status": "affected"
},
{
"version": "0.2.29",
"status": "affected"
},
{
"version": "0.2.30",
"status": "affected"
},
{
"version": "0.2.31",
"status": "affected"
},
{
"version": "0.2.32",
"status": "affected"
},
{
"version": "0.2.33",
"status": "affected"
},
{
"version": "0.2.34",
"status": "affected"
},
{
"version": "0.2.35",
"status": "affected"
},
{
"version": "0.2.36",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"baseScore": 5.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-20T14:57:43.886595Z",
"id": "CVE-2026-6608",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-670"
}
]
}
],
"references": [
{
"url": "https://gist.github.com/YLChen-007/e45039d23e698222d887ee09735d9d36",
"source": "[email protected]"
},
{
"url": "https://github.com/lm-sys/FastChat/",
"source": "[email protected]"
},
{
"url": "https://github.com/lm-sys/FastChat/issues/3834",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/792228",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/358243",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/358243/cti",
"source": "[email protected]"
}
]
}