CVE-2024-10908: FastChat open redirect vulnerability

March 20, 2025 (updated March 21, 2025)

An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.

References

github.com/advisories/GHSA-77cj-rv5x-v6r2
github.com/lm-sys/FastChat
huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2
nvd.nist.gov/vuln/detail/CVE-2024-10908

Code Behaviors & Features

Detect and mitigate CVE-2024-10908 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →