EUVD-2026-51262
GHSA-96j3-rjf9-2hxp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable via inference request with no auth or interaction (AV:N/PR:N/UI:N); code injection yields full host compromise (C/I/A:H); the non-default dumper requirement is a deployment gate, not an access-complexity increase, so AC:L retained.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.
AnalysisAI
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the optional dumper subsystem, escaping the intended sandbox when DUMPER_SERVER_PORT is configured. The flaw is code injection (CWE-95) triggered via inference requests, carrying a CVSS 9.8 with SSVC noting proof-of-concept exploit code and automatable exploitation. Currently there is publicly available exploit code exists per the CERT/CC disclosure, though EPSS remains low at 0.17% (7th percentile), and it is not listed in CISA KEV.
Technical ContextAI
SGLang is a fast serving framework for large language models and vision-language models, exposing an HTTP inference API to run model requests. The vulnerability lives in an optional 'dumper' subsystem that, when activated via the DUMPER_SERVER_PORT environment variable, opens a server intended to capture/serialize runtime state. CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code - 'Eval Injection') indicates the root cause is that attacker-influenced data reaching the dumper is dynamically evaluated/executed rather than treated as inert data, allowing a sandbox escape. Because the trigger is an ordinary inference request, the injection path is reachable from the same network surface that serves the model. The affected package is identified by CPE cpe:2.3:a:sglang:sglang:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade SGLang to a version later than v0.5.15 (the last affected release per EUVD); consult the vendor GitHub Security Advisory GHSA-h6rf-77vv-9mvj (https://github.com/sgl-project/sglang/security/advisories/GHSA-h6rf-77vv-9mvj) for the exact patched release, as no fixed version number is independently confirmed in the provided data - this reflects 'Upstream fix available via advisory; exact released patched version not independently confirmed'. As the most effective compensating control until patched, do not enable the optional dumper subsystem: leave DUMPER_SERVER_PORT unset, which removes the vulnerable code path entirely at the cost of losing dumper diagnostic functionality. If the dumper must run, restrict network access to the DUMPER_SERVER_PORT and the inference API to trusted hosts only (firewall/network policy), accepting the trade-off that legitimate remote clients must be explicitly allowlisted. Review the disclosure writeup at https://thoughts.apoorvdayal.com/posts/sglang-disclosures/ for further technical guidance.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in th
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today