CVE-2024-10908

The CVE-2024-10908 entry describes an open redirect vulnerability in lm-sys/fastchat release 0.2.36. The issue allows remote, unauthenticated attackers to redirect users to arbitrary URLs, enabling phishing, malware distribution, and credential theft. Affected component: lm-sys/fastchat, version ...

PT-2025-12129

Name of the Vulnerable Software and Affected Versions lm-sys/fastchat version git 2c68a13 Description A Server-Side Request Forgery SSRF issue was identified, allowing an attacker to access internal server resources and data, such as AWS metadata credentials, that are otherwise inaccessible...

FastChat 输入验证错误漏洞

FastChat is an open platform from LMSYS for training, deploying, and evaluating chatbots based on large language models. An input validation error vulnerability exists in FastChat version v0.2.36, which stems from an open redirection vulnerability that could lead to phishing attacks, malware...

CVE-2024-10907: Loop with Unreachable Exit Condition

In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary. Each extra character is processed in an infinit...

PT-2025-12078

Name of the Vulnerable Software and Affected Versions fastchat version 0.2.36 Description An open redirect issue allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and...

PT-2025-12077

Name of the Vulnerable Software and Affected Versions lm-sys/fastchat versions 0.2.36 and earlier Description The server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters a...

CVE-2024-12376: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials...

FastChat 资源管理错误漏洞

FastChat is an open platform from LMSYS for training, deploying, and evaluating chatbots based on large language models. A resource management error vulnerability exists in FastChat version v0.2.36, which stems from the server's inability to handle excessive characters at the end of multipart...

FastChat 资源管理错误漏洞

FastChat is an open platform from LMSYS for training, deploying and evaluating chatbots based on large language models. A resource management error vulnerability exists in FastChat version 0.2.36, which stems from improper handling of large filenames in the file upload feature and could lead to a...

PT-2025-12109

Name of the Vulnerable Software and Affected Versions lm-sys/fastchat version 0.2.36 Description A Server-Side Request Forgery SSRF issue exists, allowing an attacker to send crafted requests due to insufficient validation of the path parameter in the "/queue/join?" endpoint. This can lead to...

PT-2025-12079

Name of the Vulnerable Software and Affected Versions lm-sys/fastchat version 0.2.36 Description A Denial of Service DoS issue exists in the file upload feature due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payloa...

FastChat 代码问题漏洞

FastChat is an open platform from LMSYS for training, deploying, and evaluating chatbots based on large language models. FastChat suffers from a code issue vulnerability that stems from server-side request forgery that could lead to internal resource access...

CVE-2024-10908: URL Redirection to Untrusted Site

An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft...

CVE-2024-11603: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the /queue/join? endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal...

FastChat 代码问题漏洞

FastChat is an open platform from LMSYS for training, deploying and evaluating chatbots based on large-scale language models. A code issue vulnerability exists in FastChat version 0.2.36, which stems from insufficient validation of path parameters and could lead to a server-side request forgery...

CVE-2024-10912: Uncontrolled Resource Consumption

A Denial of Service DoS vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large...

Server-side Request Forgery (SSRF)

Overview fastchat is a fastchat with guidance support Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the workergeneratestream API endpoint. An attacker can exploit the victim controller API server's credentials to perform unauthorized web actions or...

data-agora (0.1.1), dtx (>=0.31.0, <=0.34.0) +9 more potentially affected by CVE-2024-10044 via fastchat (0.1.0)

fastchat PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastchat and may be impacted: - data-agora 0.1.1 - dtx =0.31.0, =0.2.0, =0.18.3, =0.0.2, =0.4.0, =0.0.1, =0.1.3, =0.1.0, =0.1.20 Source cves: CVE-2024-10044 Source advisory:...

CVE-2024-10044

CVE-2024-10044 describes a Server-Side Request Forgery (SSRF) in the lm-sys/fastchat Controller API Server, affecting the POST /worker_generate_stream endpoint. The vulnerability allows an attacker to misuse the controller API server’s credentials to perform unauthorized web actions or access res...

CVE-2024-10044 SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchat

A Server-Side Request Forgery SSRF vulnerability exists in the POST /workergeneratestream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's...