Critical RCE Vulnerability Discovered in SGLang Framework via GGUF Models

• •CVE-2026-5760 allows RCE via malicious GGUF model files in SGLang.
• •Attackers can exploit the vulnerability through unsandboxed Jinja2 templates.
• •No response or patch has been provided by SGLang maintainers.

A remote code execution vulnerability has been identified in the SGLang framework, specifically affecting the reranking endpoint (/v1/rerank) and tracked as CVE-2026-5760. This flaw allows attackers to exploit maliciously crafted GGUF model files containing Jinja2 templates, leading to the execution of arbitrary Python code on the server. The vulnerability arises from the unsandboxed use of jinja2.Environment() in the rendering process of chat templates. Successful exploitation could result in host compromise, lateral movement, data exfiltration, or denial-of-service attacks. The issue affects deployments of SGLang that expose the vulnerable interface to untrusted networks. Despite attempts to coordinate with project maintainers, no response or patch has been issued. The severity of this vulnerability is underscored by its potential impact on enterprise AI deployments. Security researchers recommend using ImmutableSandboxedEnvironment to mitigate the risk of exploitation.