EUVD-2026-51262
GHSA-96j3-rjf9-2hxp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable via inference request with no auth or interaction (AV:N/PR:N/UI:N); code injection yields full host compromise (C/I/A:H); the non-default dumper requirement is a deployment gate, not an access-complexity increase, so AC:L retained.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.
AnalysisAI
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the optional dumper subsystem, escaping the intended sandbox when DUMPER_SERVER_PORT is configured. The flaw is code injection (CWE-95) triggered via inference requests, carrying a CVSS 9.8 with SSVC noting proof-of-concept exploit code and automatable exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the optional dumper subsystem to be enabled with the DUMPER_SERVER_PORT environment variable set - this is the exact gating configuration and is not a default deployment mode. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a network-reachable, low-complexity, unauthenticated total-compromise scenario, and SSVC corroborates high impact (Technical Impact: total, Automatable: yes). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach an SGLang instance that has the dumper subsystem enabled (DUMPER_SERVER_PORT set) submits a crafted inference request whose payload is dynamically evaluated by the dumper, escaping the intended sandbox and executing attacker-controlled code on the host. Given AV:N/AC:L/PR:N and SSVC 'Automatable: yes', this can be performed remotely and scripted at scale; proof-of-concept exploit code exists per the CERT/CC disclosure. |
| Remediation | Upgrade SGLang to a version later than v0.5.15 (the last affected release per EUVD); consult the vendor GitHub Security Advisory GHSA-h6rf-77vv-9mvj (https://github.com/sgl-project/sglang/security/advisories/GHSA-h6rf-77vv-9mvj) for the exact patched release, as no fixed version number is independently confirmed in the provided data - this reflects 'Upstream fix available via advisory; exact released patched version not independently confirmed'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running SGLang versions 0.5.15 or earlier and determine which have DUMPER_SERVER_PORT configured. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without valid
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight ex
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile pa
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today