{"id":"CVE-2024-10908","aliases":["GHSA-77cj-rv5x-v6r2","PYSEC-2026-1394"],"title":"FastChat open redirect vulnerability","summary":"FastChat open redirect vulnerability","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendor":"fschat","product":"fschat","ecosystem":"pip","affected":["fschat <= 0.2.36"],"published":"2025-03-20","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-77cj-rv5x-v6r2","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10908"},{"url":"https://github.com/lm-sys/FastChat"},{"url":"https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2"}],"tags":["osv","pip","exploit-available"],"epss":0.00775,"epssPercentile":0.5429,"ingestedAt":"2026-07-08T18:25:46.800Z","exploits":{"nuclei":["CVE-2024-10908"],"checkedAt":"2026-09-23T07:13:31.895Z"},"exploitAvailable":true,"slug":"CVE-2024-10908","body":"## Overview\n\nAn open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.\n\n## Affected packages\n\n- `fschat <= 0.2.36`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":4764,"id":"CVE-2024-10908","ts":1788887204996,"field":"exploit_available","old":"false","new":"true"},{"seq":3647,"id":"CVE-2024-10908","ts":1788886320663,"field":"exploit_available","old":"true","new":"false"},{"seq":2498,"id":"CVE-2024-10908","ts":1788882989054,"field":"exploit_available","old":"false","new":"true"},{"seq":1527,"id":"CVE-2024-10908","ts":1788882402719,"field":"exploit_available","old":"true","new":"false"},{"seq":641,"id":"CVE-2024-10908","ts":1788881840446,"field":"exploit_available","old":"false","new":"true"}]}