EUVD-2026-51267
GHSA-359v-m36h-r94v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable endpoint deserializes untrusted pickle with no authentication or interaction (AV:N/AC:L/PR:N/UI:N), yielding full host RCE, so C/I/A all High.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.
AnalysisAI
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary commands by abusing the /load_lora_adapter_from_tensors endpoint, which deserializes attacker-supplied base64-encoded pickle payloads. The framework's SafeUnpickler relies on an incomplete denylist that can be bypassed, so a crafted pickle stream reaches dangerous reduce logic and executes OS commands on the serving host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the SGLang HTTP API and specifically the /load_lora_adapter_from_tensors endpoint, which must be enabled/exposed; the attacker submits a crafted base64-encoded pickle payload engineered to bypass SafeUnpickler's incomplete denylist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes the worst-case profile: network-reachable, low-complexity, unauthenticated, full-impact RCE, consistent with SSVC's 'Automatable: yes' and 'Technical Impact: total.' However, the signals are not uniformly alarming: SSVC lists Exploitation as 'none' (no observed exploitation), the CVE is not on CISA KEV, and EPSS is only 0.65% (48th percentile), indicating no evidence of active, widespread exploitation yet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach an exposed SGLang server sends an HTTP request to /load_lora_adapter_from_tensors containing a base64-encoded pickle payload crafted to evade the SafeUnpickler denylist. When SGLang deserializes it, the embedded reduce logic executes attacker-chosen OS commands in the context of the serving process, yielding full host compromise. … |
| Remediation | Upgrade SGLang to a fixed release beyond 0.5.15 as published in the vendor GitHub Security Advisory (GHSA-2wvm-gjg7-5jfm at https://github.com/sgl-project/sglang/security/advisories/GHSA-2wvm-gjg7-5jfm); the advisory is the authoritative source for the exact patched version, which is not independently confirmed in the available data - do not rely on an assumed version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately inventory all SGLang deployments (versions 0.5.15 and below) across production and staging environments and restrict network access to the /load_lora_adapter_from_tensors endpoint using firewall rules, API gateway controls, or WAF policies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without valid
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight ex
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile pa
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today