SGLang vulnerabilities

SGLang contains a remote code execution (RCE) vulnerability when loading model weights from a HuggingFace repository. In the /update_weights_from_disk endpoint, torch.load with weights_only=False allows pickle deserialization of .bin files.

SGLang contains a remote code execution (RCE) vulnerability in the optional dumper subsystem. When DUMPER_SERVER_PORT is set, a sandbox escape is possible, enabling code execution on inference requests.

SGLang contains an unauthenticated remote code execution (RCE) vulnerability in the /load_lora_adapter_from_tensors endpoint. It bypasses SafeUnpickler's incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

The vulnerability in SGLang involves an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface without authentication or deserialization safeguards. This allows an attacker to provide a malicious pickle file, resulting in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

SGLang contains a model weight exfiltration vulnerability when no API keys are configured. SGLang exposes two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then trigger data transfer, enabling exfiltration of all model weights.

SGLang contains a credential leakage vulnerability in the /server_info endpoint. When only the --admin-api-key is configured, this endpoint returns API keys and SSL keyfile information.

SGLang contains an SSRF and local file read vulnerability in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.

Vulnerability in SGLang up to version 0.5.11 in the data_hash function of the Cache Handler component causes denial of service (DoS) via a local attack with high complexity. Exploit has been published.

In SGLang 0.5.10.post1, a reachable assertion vulnerability exists in the file python/sglang/srt/lora/lora_manager.py of the Inference HTTP Endpoint component via the lora_path argument. The attack is remote with high complexity, and an exploit has been disclosed.