cve.bz

CVE-2024-12376

7.5 highEPSS 0.8%

High (7.5) in lm-sys fastchat. EPSS 0.8% chance of exploitation in the next 30 days.

A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials.

Severity

CVSS 3.0

7.5 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-11-01)
CWE
CWE-918
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g44m-hpf4-vmrpPyPIfschat<=0.2.36no fix published
PYSEC-2026-1396PyPIfschat<=0.2.36no fix published

References

Check your stackJSON