Read the docs

lm-sys

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

lm-sys records in CISA KEV

No lm-sys vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Fastchat 6 records HIGH

Records

6 records in Fastchat · all components

TI-2024-09320 CVE-2024-10044 · GHSA-h6qm-w442-h848

SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchat

Priority HIGH 79

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765.

CVSS 3.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00529 Published 2024-12-30 No fix listed CWE-918
TI-2024-11482 CVE-2024-12376 · GHSA-g44m-hpf4-vmrp

Server Side Request Forgery in lm-sys/fastchat

Priority HIGH 72

A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00761 Published 2025-03-20 No fix listed CWE-918
TI-2024-10750 CVE-2024-11603 · GHSA-h254-g997-685c

Server-Side Request Forgery in lm-sys/fastchat

Priority HIGH 72

A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.007 Published 2025-03-20 No fix listed CWE-918
TI-2024-10115 CVE-2024-10912 · GHSA-79rp-v9rm-gxm8

Denial of Service in lm-sys/fastchat

Priority HIGH 72

A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00637 Published 2025-03-20 No fix listed CWE-400
TI-2024-10112 CVE-2024-10908 · GHSA-77cj-rv5x-v6r2

Open Redirect in lm-sys/fastchat

Priority MEDIUM 60

An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00784 Published 2025-03-20 No fix listed CWE-601
Open these records in search →