{"data":{"id":"ecfc61b2-3cfb-455e-9718-ffdc8d4db6e7","title":"CVE-2026-6608: A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena…","summary":"CVE-2026-6608 affects lm-sys fastchat up to 0.2.36, specifically the add_text function of the Arena Side-by-Side View Handler component. The flaw is an incorrect control flow (CWE-670) that can be triggered remotely, and a public exploit now exists. VulDB rates it CVSS 4.0 5.5 MEDIUM, while NVD has not yet provided an assessment.","solution":"The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but the source states that three other files were missed.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6608","publishedAt":"2026-04-20T06:16:21.733Z","cveId":"CVE-2026-6608","cweIds":["CWE-670"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["fschat@<= 0.2.36"],"affectedPackageNames":["fschat"],"affectedPackageRefs":["pypi:fschat"],"affectedVendors":[],"affectedVendorsRaw":["FastChat","Arena Side-by-Side View Handler"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"lm-sys fastchat Arena side-by-side view handler flaw in add_text","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00511,"epssCheckedAt":"2026-10-14T18:05:59.274Z","kevDateAdded":null,"advisoryAliases":["GHSA-f3q6-69f3-vwch"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:24.046Z","patchAvailable":null,"disclosureDate":"2026-04-20T06:16:21.733Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}