SGLang CVE-2026-7669
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unsafe deserialization in SGLang's HuggingFace Transformer Handler allows remote attackers to trigger deserialization attacks via the get_tokenizer function in versions up to 0.5.9, potentially leading to code execution or information disclosure. The vulnerability requires high attack complexity and has not been patched despite early vendor notification.
Technical ContextAI
The vulnerability exists in the get_tokenizer function within python/sglang/srt/utils/hf_transformers_utils.py, which handles HuggingFace Transformer model tokenization. The root cause is improper input validation during deserialization operations (CWE-20: Improper Input Validation), a common weakness in Python applications that deserialize untrusted data without validation. This typically affects Python pickle operations, YAML/JSON parsing, or similar deserialization mechanisms used when loading tokenizer configurations from HuggingFace repositories or local paths. The HuggingFace Transformer Handler component is responsible for integrating pre-trained transformer models, making it a critical attack surface for model loading operations.
Affected ProductsAI
SGLang versions up to and including 0.5.9 are affected, specifically the HuggingFace Transformer Handler component. The vulnerability impacts the python/sglang/srt/utils/hf_transformers_utils.py module. No patched version has been publicly released; affected organizations should track the SGLang GitHub repository (https://github.com/hiyouga/sglang) for security updates.
RemediationAI
Upgrade SGLang to a version newer than 0.5.9 once a patch is released by the project maintainers; monitor the official SGLang repository releases page for security updates. Until a patch is available, implement compensating controls by restricting network access to SGLang API endpoints using firewall rules or service mesh policies to limit remote access, validating and sanitizing all tokenizer configuration inputs before passing them to the get_tokenizer function, and disabling automatic model downloading from untrusted HuggingFace repositories by hardcoding trusted model IDs or using local model caches with file integrity verification. These mitigations trade off operational flexibility for security; hardcoding model IDs may require code changes for model updates, and network restrictions may hinder legitimate remote access patterns.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-20 – Improper Input Validation
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today