Executive brief
freegpt-webui is a web interface for accessing GPT models. A flaw in its Jailbreak Mode component allows remote attackers to repeatedly send requests that permanently degrade the application's performance and consume upstream API tokens by causing unbounded memory growth that affects all users. This can lead to service unavailability and increased operational costs.
Technical details
The vulnerability is a global state mutation flaw (CWE-284) in the getJailbreak function of server/backend.py. The function repeatedly appends instruction text to a module-level shared dictionary on each request with a non-default jailbreak mode, causing the instructions to grow exponentially across all requests and users. Additionally, the function performs an unsafe membership check after dictionary access, allowing any invalid jailbreak value to raise an unhandled KeyError. An unauthenticated attacker can remotely exploit this by sending repeated POST requests with invalid or valid jailbreak parameters, causing the prompt to grow by ~500 characters per request and eventually exceed model context windows, degrading service for all users and wasting API tokens.
Affected products
- ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc
Timeline
- 2026-09-04: disclosed
- other: Product is archived and no longer maintained