Three Rces In Sglang

SGLang is a widely-used open-source framework for serving large language models and multimodal AI models.

Antiproof identified three vulnerabilities in SGLang that allow an unauthenticated attacker to achieve remote code execution on the host running SGLang. We responsibly disclosed the vulnerabilities to the vendor and subsequently coordinated disclosure with CERT/CC (case VU#777338 ). As of publication, no official patch is available, and the vendor did not respond during coordination.

CVSS 3.1 scores are Antiproof's assessment. The --enable-custom-logit-processor flag is off by default but recommended by SGLang's documentation for serving DeepSeek-R1 and GLM-4.

Two of the three vulnerabilities involve unsafe deserialization, a vulnerability class explicitly warned against in Python's documentation . A crafted serialized payload can achieve remote code execution when deserialized by pickle.loads() or dill.loads() :

The multimodal generation runtime's scheduler binds a ZeroMQ ROUTER socket on the configured --host . Although the code default is 127.0.0.1 , SGLang's official installation guide uses --host 0.0.0.0 in every serving example (Docker, SkyPilot, AWS SageMaker), and the official Docker Compose configuration deploys with network_mode: host , meaning the socket is exposed on all network interfaces in standard deployments.

An unauthenticated attacker can send a malicious pickle that reaches the scheduler's pickle.loads() call:

This vulnerability is distinct from CVE-2026-3059, the ZeroMQ broker described below. The broker binds to all interfaces unconditionally regardless of --host , while the scheduler ROUTER socket is reachable only when --host 0.0.0.0 is set.

The multimodal generation runtime accepts file uploads on its OpenAI-compatible image and video editing endpoints, /v1/images/edits and /v1/videos . Both endpoints route uploads through a shared helper, _save_upload_to_path , which writes to the path it receives:

The caller constructs target_path by joining the client-supplied multipart filename directly into the uploads directory, without sanitization:

An unauthenticated attacker can write arbitrary files to any location the server process has access to by sending a filename containing ../ that traverses out of the uploads directory.

SGLang's serving runtime accepts a custom_logit_processor field on its generation endpoints. The field carries a JSON string whose callable property contains a hex-encoded dill payload, which the server deserializes without validation:

An unauthenticated attacker can remotely execute code on any SGLang host that enables the --enable-custom-logit-processor flag by sending a malicious pickle to its generation endpoint.

The multimodal generation runtime also starts a ZeroMQ broker that binds a REP socket on all interfaces, regardless of --host , and invokes pickle.loads() on every received message:

Antiproof identified this vulnerability independently, and we responsibly disclosed it to the SGLang maintainers on 2026-03-10, alongside the three vulnerabilities above. On 2026-03-11, Orca Security published a blog post covering the same broker vulnerability, tracked as CVE-2026-3059 and credited to Orca.

As of publication, no official patch is available. Operators are advised not to expose SGLang's service interfaces to untrusted networks.

Thanks to Christopher Cullen at CERT/CC for coordinating disclosure and authoring Vulnerability Note VU#777338.