Advisoriesby IbisFastChatGHSA-77cj-rv5x-v6r2
FastChat open redirect vulnerability
No fix yet
An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| fschat PyPI | <= 0.2.36 | No fix yet |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-601
- Also known as
- CVE-2024-10908, PYSEC-2026-1394
More FastChat advisories
All FastChat
FastChat has a Content Moderation Bypass via Arena Side-by-Side ViewsCVE-2026-6608no fix yetFastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)CVE-2026-6607no fix yetFastChat Server-Side Request Forgery vulnerabilityCVE-2024-12376no fix yetFastChat Server-Side Request Forgery vulnerabilityCVE-2024-11603no fix yetFastChat Denial of Service vulnerabilityCVE-2024-10912no fix yetFastChat Uncontrolled Resource Consumption vulnerabilityCVE-2024-10907no fix yet