This vulnerability in lm-sys fastchat (up to version 0.2.36) involves incorrect control flow manipulation in the add_text function of the Arena Side-by-Side View Handler component. The flaw allows an unauthenticated remote attacker to influence the program's control flow, potentially leading to unintended behavior. A partial fix was applied to one file (gradio_block_arena_named.py), but three other files remain unaddressed, leaving the vulnerability present. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on integrity. No official patch or remediation level has been published.

The vulnerability allows remote attackers to manipulate control flow in the affected component without authentication or user interaction, which may lead to unintended program behavior. The CVSS score of 6.9 (medium severity) reflects a moderate impact primarily on integrity. No known exploits in the wild have been reported, but the exploit code is publicly available, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Although a partial fix was committed for one file, other affected files remain unpatched. Users should monitor official lm-sys communications for updates and apply any forthcoming patches promptly. Until an official fix is released, consider limiting exposure of the vulnerable component to untrusted networks if possible.