AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

FastChatGHSA-g44m-hpf4-vmrp

FastChat Server-Side Request Forgery vulnerability

FastChat

CVE-2024-12376 · Published Mar 20, 2025 · updated Jul 7, 2026

High7.5
No fix yet
GitHub advisory

A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials.

Affected versions

PackageAffectedFixed in
fschat
PyPI
<= 0.2.36No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-918
Also known as
CVE-2024-12376, PYSEC-2026-1396

More FastChat advisories

All FastChat
Medium 5.3Apr 20FastChat has a Content Moderation Bypass via Arena Side-by-Side ViewsCVE-2026-6608no fix yetMedium 5.3Apr 20FastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)CVE-2026-6607no fix yetHigh 7.5Mar 20, 2025FastChat Server-Side Request Forgery vulnerabilityCVE-2024-11603no fix yetMedium 6.1Mar 20, 2025FastChat open redirect vulnerabilityCVE-2024-10908no fix yetHigh 7.5Mar 20, 2025FastChat Denial of Service vulnerabilityCVE-2024-10912no fix yetHigh 7.5Mar 20, 2025FastChat Uncontrolled Resource Consumption vulnerabilityCVE-2024-10907no fix yet