CVE-2026-6608: lm-sys fastchat Arena side-by-side view handler flaw in add_text

Summary

CVE-2026-6608 affects lm-sys fastchat up to 0.2.36, specifically the add_text function of the Arena Side-by-Side View Handler component. The flaw is an incorrect control flow (CWE-670) that can be triggered remotely, and a public exploit now exists. VulDB rates it CVSS 4.0 5.5 MEDIUM, while NVD has not yet provided an assessment.

Mitigation

The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but the source states that three other files were missed.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• fschatPyPILLM dependency since 2023-04-16

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database