Vendors / lm-sys Records 10 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 4
Exploited now lm-sys records in CISA KEV No lm-sys vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 79
A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765.
CVSS 3.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00529 · Published 2024-12-30 · No fix listed CWE-918
Priority HIGH 72
A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00761 · Published 2025-03-20 · No fix listed CWE-918
Priority HIGH 72
A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.007 · Published 2025-03-20 · No fix listed CWE-918
Priority HIGH 72
A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00637 · Published 2025-03-20 · No fix listed CWE-400
Priority HIGH 72
In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.007 · Published 2025-03-20 · No fix listed CWE-835
Priority HIGH 70
A vulnerability was detected in lm-sys fastchat up to 0.2.36.
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00308 · Published 2026-04-20 · No fix listed CWE-670
Priority HIGH 70
A security vulnerability has been detected in lm-sys fastchat up to 0.2.36.
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00623 · Published 2026-04-20 · No fix listed CWE-400
Priority MEDIUM 60
An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00784 · Published 2025-03-20 · No fix listed CWE-601
Priority MEDIUM 49
FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.0072 · Published 2026-09-04 · No fix listed CWE-306
Priority LOW 21
A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36.
CVSS 4.0 MEDIUM 4.8· Local · Low privileges · No interaction · EPSS 0.00206 · Published 2025-04-16 · No fix listed CWE-20
Open these records in search → All records by CVSS severity
2 4 4 0 0
THREATIST.IORead the docs