EUVD-2026-51267
GHSA-359v-m36h-r94v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable endpoint deserializes untrusted pickle with no authentication or interaction (AV:N/AC:L/PR:N/UI:N), yielding full host RCE, so C/I/A all High.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.
AnalysisAI
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary commands by abusing the /load_lora_adapter_from_tensors endpoint, which deserializes attacker-supplied base64-encoded pickle payloads. The framework's SafeUnpickler relies on an incomplete denylist that can be bypassed, so a crafted pickle stream reaches dangerous reduce logic and executes OS commands on the serving host. Rated CVSS 9.8 with SSVC total technical impact and marked automatable; no public exploit has been confirmed and EPSS is a modest 0.65% (48th percentile), so widespread automated exploitation is not yet evidenced.
Technical ContextAI
SGLang is a high-performance serving runtime for large language models, exposing HTTP endpoints for model and adapter management. The affected surface is the LoRA adapter loading path (/load_lora_adapter_from_tensors), which accepts serialized tensor data. The root cause is CWE-502 (Deserialization of Untrusted Data): SGLang attempts to mitigate pickle's inherent code-execution risk with a SafeUnpickler that enforces a denylist of forbidden classes/modules, but denylist-based pickle filtering is fundamentally fragile - any class or global not enumerated (or reachable via an alias/alternate import path) slips through. Because Python's pickle invokes __reduce__/__reduce_ex__ during load, a payload that references a permitted-but-dangerous callable executes at unpickle time, before any application-level validation.
RemediationAI
Upgrade SGLang to a fixed release beyond 0.5.15 as published in the vendor GitHub Security Advisory (GHSA-2wvm-gjg7-5jfm at https://github.com/sgl-project/sglang/security/advisories/GHSA-2wvm-gjg7-5jfm); the advisory is the authoritative source for the exact patched version, which is not independently confirmed in the available data - do not rely on an assumed version number. If immediate patching is not possible, restrict network access to the SGLang management/inference API so the /load_lora_adapter_from_tensors endpoint is not reachable from untrusted networks (bind to localhost or place behind an authenticating reverse proxy and firewall), and disable or block dynamic LoRA adapter loading from tensors if your deployment does not require it, accepting the trade-off that runtime adapter hot-loading will no longer function. Because the flaw is deserialization-based, treating any pickle-loading endpoint as an RCE primitive and denying external access to it is the most reliable compensating control until the patch is applied.
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in th
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today