LM-Sys FastChat <= 0.2.36 Content Moderation Bypass (CVE-670)

Vulnerability Summary: LM-Sys FastChat <= 0.2.36 Content Moderation Bypass (CVE-670) Vulnerability Overview The LM-Sys FastChat platform (including Anonymous Arena and Vision Arenas modes) contains a content moderation bypass vulnerability. In certain modules, due to a copy-paste error, the application incorrectly reads instead of , causing the entire conversation context to be replaced by the user’s short input message, thereby skipping conversation history checks. Impact Scope Affected Versions: LM-Sys FastChat <= 0.2.36 Affected Modules: - - - Vulnerability Type: Content moderation bypass, security policy violation Remediation Replace the erroneously used in the code with the correct to ensure that Model B’s generation history is properly read. POC Code Exploitation Steps 1. Navigate to the FastChat Anonymous Arena (Battle) or Vision Anonymous Arena web interface. 2. Initiate multi-turn conversations. First, prompt both models to generate content that may approach but pass moderation boundaries. 3. In the second turn, send a short benign follow-up prompt (e.g., “Tell me more” or “Continue”). The backend evaluates the short prompt without checking Model B’s prior context, allowing severely policy-violating contexts to persist indefinitely, because the content moderation filter discards the historical window. Impact Content Moderation Bypass: Completely ignores Model B’s history, leading to indefinite persistence of severely policy-violating contexts. Security Policy Violation: Users can generate unrestricted harmful text or images, safely bypassing filters across multiple consecutive conversation turns.

Goal Reached Thanks to every supporter — we hit 100%!

LM-Sys FastChat <= 0.2.36 Content Moderation Bypass (CVE-670)