Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-12376Server Side Request Forgery in lm-sys/fastchat
High 7.5
In plain English
A high-severity server-side request forgery in lm-sys/fastchat from lm-sys. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.0)7.5High
Exploit odds (30 days)0.8%top 44.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | fschat | no fix listed | GHSA-g44m-hpf4-vmrp |
| PyPI | fschat | no fix listed | PYSEC-2026-1396 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| lm-sys | lm-sys/fastchat | unspecified – through latest |
Weakness: CWE-918 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N