Sglang
Monthly
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary commands by abusing the /load_lora_adapter_from_tensors endpoint, which deserializes attacker-supplied base64-encoded pickle payloads. The framework's SafeUnpickler relies on an incomplete denylist that can be bypassed, so a crafted pickle stream reaches dangerous reduce logic and executes OS commands on the serving host. Rated CVSS 9.8 with SSVC total technical impact and marked automatable; no public exploit has been confirmed and EPSS is a modest 0.65% (48th percentile), so widespread automated exploitation is not yet evidenced.
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight exfiltration when the server is deployed without API key authentication. Attackers can abuse distributed weight broadcasting via NCCL - the same mechanism used for legitimate inter-GPU weight distribution - to redirect all model weights to an attacker-controlled destination, resulting in total confidentiality loss of what may be highly valuable proprietary ML assets. No public exploit code or CISA KEV listing is confirmed at time of analysis; EPSS at 0.19% (9th percentile) reflects low observed exploitation activity, consistent with this being a targeted threat against specialized ML infrastructure rather than opportunistic mass exploitation.
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile paths to any network-reachable caller on all versions through v0.5.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and SSVC classifies the attack as automatable with a proof-of-concept available, making mass scanning for exposed instances a realistic threat. EPSS sits at just 0.14% (4th percentile), reflecting SGLang's niche deployment footprint rather than any technical difficulty - for internet-facing deployments using --admin-api-key, this is a high-priority credential-rotation and patching event.
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the inference server by abusing the /update_weights_from_disk endpoint, which falls back to torch.load(..., weights_only=False) and thus deserializes attacker-controlled pickle streams embedded in .bin model-weight files. Because SGLang's HTTP serving API is typically exposed without authentication, an attacker able to reach the endpoint and influence the loaded weights path can achieve code execution as the serving process. This is a CWE-502 deserialization flaw rated CVSS 9.8; a vendor security advisory (GHSA-wf98-gv64-5wrf) and a public technical disclosure exist, though EPSS remains low (0.26%, 18th percentile) and it is not in CISA KEV - no public exploit identified at time of analysis beyond the disclosure write-up.
Server-Side Request Forgery and local file read in SGLang's multimodal inference endpoint allows authenticated API users to exfiltrate cloud metadata, internal service responses, and secrets. The `/v1/chat/completions` endpoint accepts an `image_url` parameter that the server fetches without sanitization, enabling pivot to internal networks and cloud IMDS endpoints. Affecting all SGLang releases through v0.5.15, this is a high-confidentiality-impact flaw with no public exploit or CISA KEV listing identified at time of analysis, and an EPSS of 0.14% (4th percentile) suggesting limited opportunistic exploitation to date.
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the optional dumper subsystem, escaping the intended sandbox when DUMPER_SERVER_PORT is configured. The flaw is code injection (CWE-95) triggered via inference requests, carrying a CVSS 9.8 with SSVC noting proof-of-concept exploit code and automatable exploitation. Currently there is publicly available exploit code exists per the CERT/CC disclosure, though EPSS remains low at 0.17% (7th percentile), and it is not listed in CISA KEV.
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsystem binds a ZeroMQ PULL socket to a routable interface without authentication or safe deserialization, letting a network attacker send a crafted pickle payload that executes arbitrary code in the serving process. It affects deployments where the elastic expert-parallel backup feature is enabled and the socket is reachable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Hash collision weaknesses in SGLang's multimodal Cache Handler (all versions through 0.5.11) allow a local low-privilege attacker to craft multimodal tensor inputs that produce identical cache keys via truncated SHA256 digests, causing incorrect cache lookups or cache invalidation failures that disrupt LLM serving workflows. The CVSS 4.0 score of 1.1 reflects the strictly local attack vector and high exploitation complexity, limiting real-world impact primarily to multi-tenant inference deployments. Publicly available exploit code exists per GitHub issue #25462, though no confirmed active exploitation has been observed and the vulnerability is not listed in the CISA KEV catalog.
Reachable assertion in SGLang 0.5.10.post1's LoRA adapter scheduler allows a remote unauthenticated attacker to trigger a denial of service via a crafted `lora_path` argument to the inference HTTP endpoint. The root cause is a logic flaw in the batch prefill scheduler: chunked LoRA prefill requests already admitted to the prefill queue are invisible to the LoRA admission check, enabling N+1 distinct adapters to be submitted when `max_loras_per_batch=N`, which forces an assertion failure in `lora_manager.py`. A publicly available proof-of-concept exists (no public exploit identified at time of analysis in the KEV sense), and the CVSS 4.0 score of 2.9 reflects high attack complexity and limited availability impact.
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 arises when the non-default `--enable-custom-logit-processor` flag is set, allowing attacker-supplied Python objects to be deserialized via `dill.loads()` and execute arbitrary code on the inference host. No CISA KEV listing exists and SSVC records exploitation as 'none', but a public technical write-up (antiproof.ai, 'Three RCEs in SGLang') details the flaw and SSVC marks it automatable with total technical impact. EPSS is modest at 0.32% (55th percentile), consistent with a serious-but-conditional (feature-gated) issue rather than mass exploitation.
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker to place files anywhere the server process can write by embedding ../ sequences in an upload filename sent to specific endpoints. Because the affected process typically runs LLM inference workloads, a written file can be leveraged toward code execution or service disruption. A public technical write-up describing multiple SGLang RCEs exists, though the EPSS probability is very low (0.07%) and the issue is not listed in CISA KEV.
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, where the generation runtime scheduler's ZeroMQ ROUTER socket binds to 0.0.0.0 by default and deserializes incoming messages with pickle.loads(). Any attacker who can reach the exposed scheduler port can send a crafted pickle payload to execute arbitrary code on the host with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, though a vendor-independent technical writeup ('three RCEs in sglang') describes the flaw; EPSS is low (0.05%) and SSVC records no observed exploitation, but the issue is rated automatable with total technical impact.
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code by loading specially crafted model files with malicious Jinja2 templates. The vulnerability stems from unsandboxed rendering of tokenizer.chat_template fields, enabling template injection attacks. Publicly available exploit code exists (GitHub POC by Stuub). With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and SSVC ratings of automatable with total technical impact, this represents critical risk for exposed SGLang deployments handling untrusted model files.
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in the disaggregation module's inter-process communication. Same class of vulnerability as CVE-2026-3059 in a different code path.
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker, enabling remote code execution. Any attacker who can reach the ZMQ port can execute arbitrary Python code on the ML inference server.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary commands by abusing the /load_lora_adapter_from_tensors endpoint, which deserializes attacker-supplied base64-encoded pickle payloads. The framework's SafeUnpickler relies on an incomplete denylist that can be bypassed, so a crafted pickle stream reaches dangerous reduce logic and executes OS commands on the serving host. Rated CVSS 9.8 with SSVC total technical impact and marked automatable; no public exploit has been confirmed and EPSS is a modest 0.65% (48th percentile), so widespread automated exploitation is not yet evidenced.
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight exfiltration when the server is deployed without API key authentication. Attackers can abuse distributed weight broadcasting via NCCL - the same mechanism used for legitimate inter-GPU weight distribution - to redirect all model weights to an attacker-controlled destination, resulting in total confidentiality loss of what may be highly valuable proprietary ML assets. No public exploit code or CISA KEV listing is confirmed at time of analysis; EPSS at 0.19% (9th percentile) reflects low observed exploitation activity, consistent with this being a targeted threat against specialized ML infrastructure rather than opportunistic mass exploitation.
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile paths to any network-reachable caller on all versions through v0.5.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and SSVC classifies the attack as automatable with a proof-of-concept available, making mass scanning for exposed instances a realistic threat. EPSS sits at just 0.14% (4th percentile), reflecting SGLang's niche deployment footprint rather than any technical difficulty - for internet-facing deployments using --admin-api-key, this is a high-priority credential-rotation and patching event.
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the inference server by abusing the /update_weights_from_disk endpoint, which falls back to torch.load(..., weights_only=False) and thus deserializes attacker-controlled pickle streams embedded in .bin model-weight files. Because SGLang's HTTP serving API is typically exposed without authentication, an attacker able to reach the endpoint and influence the loaded weights path can achieve code execution as the serving process. This is a CWE-502 deserialization flaw rated CVSS 9.8; a vendor security advisory (GHSA-wf98-gv64-5wrf) and a public technical disclosure exist, though EPSS remains low (0.26%, 18th percentile) and it is not in CISA KEV - no public exploit identified at time of analysis beyond the disclosure write-up.
Server-Side Request Forgery and local file read in SGLang's multimodal inference endpoint allows authenticated API users to exfiltrate cloud metadata, internal service responses, and secrets. The `/v1/chat/completions` endpoint accepts an `image_url` parameter that the server fetches without sanitization, enabling pivot to internal networks and cloud IMDS endpoints. Affecting all SGLang releases through v0.5.15, this is a high-confidentiality-impact flaw with no public exploit or CISA KEV listing identified at time of analysis, and an EPSS of 0.14% (4th percentile) suggesting limited opportunistic exploitation to date.
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the optional dumper subsystem, escaping the intended sandbox when DUMPER_SERVER_PORT is configured. The flaw is code injection (CWE-95) triggered via inference requests, carrying a CVSS 9.8 with SSVC noting proof-of-concept exploit code and automatable exploitation. Currently there is publicly available exploit code exists per the CERT/CC disclosure, though EPSS remains low at 0.17% (7th percentile), and it is not listed in CISA KEV.
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsystem binds a ZeroMQ PULL socket to a routable interface without authentication or safe deserialization, letting a network attacker send a crafted pickle payload that executes arbitrary code in the serving process. It affects deployments where the elastic expert-parallel backup feature is enabled and the socket is reachable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Hash collision weaknesses in SGLang's multimodal Cache Handler (all versions through 0.5.11) allow a local low-privilege attacker to craft multimodal tensor inputs that produce identical cache keys via truncated SHA256 digests, causing incorrect cache lookups or cache invalidation failures that disrupt LLM serving workflows. The CVSS 4.0 score of 1.1 reflects the strictly local attack vector and high exploitation complexity, limiting real-world impact primarily to multi-tenant inference deployments. Publicly available exploit code exists per GitHub issue #25462, though no confirmed active exploitation has been observed and the vulnerability is not listed in the CISA KEV catalog.
Reachable assertion in SGLang 0.5.10.post1's LoRA adapter scheduler allows a remote unauthenticated attacker to trigger a denial of service via a crafted `lora_path` argument to the inference HTTP endpoint. The root cause is a logic flaw in the batch prefill scheduler: chunked LoRA prefill requests already admitted to the prefill queue are invisible to the LoRA admission check, enabling N+1 distinct adapters to be submitted when `max_loras_per_batch=N`, which forces an assertion failure in `lora_manager.py`. A publicly available proof-of-concept exists (no public exploit identified at time of analysis in the KEV sense), and the CVSS 4.0 score of 2.9 reflects high attack complexity and limited availability impact.
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 arises when the non-default `--enable-custom-logit-processor` flag is set, allowing attacker-supplied Python objects to be deserialized via `dill.loads()` and execute arbitrary code on the inference host. No CISA KEV listing exists and SSVC records exploitation as 'none', but a public technical write-up (antiproof.ai, 'Three RCEs in SGLang') details the flaw and SSVC marks it automatable with total technical impact. EPSS is modest at 0.32% (55th percentile), consistent with a serious-but-conditional (feature-gated) issue rather than mass exploitation.
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker to place files anywhere the server process can write by embedding ../ sequences in an upload filename sent to specific endpoints. Because the affected process typically runs LLM inference workloads, a written file can be leveraged toward code execution or service disruption. A public technical write-up describing multiple SGLang RCEs exists, though the EPSS probability is very low (0.07%) and the issue is not listed in CISA KEV.
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, where the generation runtime scheduler's ZeroMQ ROUTER socket binds to 0.0.0.0 by default and deserializes incoming messages with pickle.loads(). Any attacker who can reach the exposed scheduler port can send a crafted pickle payload to execute arbitrary code on the host with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, though a vendor-independent technical writeup ('three RCEs in sglang') describes the flaw; EPSS is low (0.05%) and SSVC records no observed exploitation, but the issue is rated automatable with total technical impact.
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code by loading specially crafted model files with malicious Jinja2 templates. The vulnerability stems from unsandboxed rendering of tokenizer.chat_template fields, enabling template injection attacks. Publicly available exploit code exists (GitHub POC by Stuub). With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and SSVC ratings of automatable with total technical impact, this represents critical risk for exposed SGLang deployments handling untrusted model files.
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in the disaggregation module's inter-process communication. Same class of vulnerability as CVE-2026-3059 in a different code path.
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker, enabling remote code execution. Any attacker who can reach the ZMQ port can execute arbitrary Python code on the ML inference server.