PT-2026-33714 · Lmsys · Fastchat

Eric-F · Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-6608

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions lm-sys fastchat versions prior to 0.2.37

Description Remote Code Execution is possible in the Arena Side-by-Side View Handler component via the add text() function. Manipulation of this function results in incorrect control flow, allowing an attack to be launched remotely.

Recommendations Update to version 0.2.37 or later. As a temporary workaround, restrict access to the add text() function within the Arena Side-by-Side View Handler.

Exploit

Fix

RCE

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2026-6608

GHSA-F3Q6-69F3-VWCH

Affected Products

Fastchat

References · 10

• 🔥 https://gist.github.com/YLChen-007/e45039d23e698222d887ee09735d9d36 · Exploit
• https://osv.dev/vulnerability/GHSA-f3q6-69f3-vwch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6608 · Security Note
• https://github.com/lm-sys/FastChat · Note
• https://github.com/lm-sys/FastChat/issues/3834 · Note
• https://twitter.com/VulmonFeeds/status/2046134050096550256 · Twitter Post
• https://vuldb.com/vuln/358243/cti · Note
• https://vuldb.com/vuln/358243 · Note
• https://twitter.com/CVEnew/status/2046601510612512887 · Twitter Post
• https://vuldb.com/submit/792228 · Note