A vulnerability labeled as problematic has been found in lm-sys fastchat up to 0.2.36. Impacted is the function
add_text of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow.
This vulnerability is reported as CVE-2026-6608. The attack can be launched remotely. Moreover, an exploit is present.
The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but three other files were missed.
