🎯Basically, a flaw in SGLang lets attackers run harmful code on servers.
What Happened
A serious security vulnerability has been identified in SGLang, a high-performance open-source framework for serving large language models. This vulnerability, tracked as CVE-2026-5760, has received a CVSS score of 9.8, indicating a critical risk. The flaw allows for remote code execution (RCE) through malicious GGUF model files.
The Flaw
The vulnerability arises from a command injection issue that affects the reranking endpoint at /v1/rerank. An attacker can exploit this flaw by creating a specially crafted GGUF model file that contains a malicious tokenizer.chat_template parameter. This parameter can trigger a Jinja2 server-side template injection (SSTI) payload, leading to the execution of arbitrary Python code on the server.
What's at Risk
If successfully exploited, this vulnerability could allow attackers to execute any code they choose on the affected SGLang server. This could lead to severe consequences, including data breaches, service interruptions, or further exploitation of the server environment.
Attack Sequence
- An attacker creates a GGUF model file with a malicious tokenizer.chat_template.
- The template includes a specific trigger phrase that activates the vulnerable code path in SGLang.
- A victim downloads and loads this model into SGLang.
- When a request is made to the
/v1/rerankendpoint, SGLang processes the chat_template, executing the attacker's code.
Patch Status
Currently, there is no patch available for this vulnerability. Security researchers recommend using ImmutableSandboxedEnvironment instead of jinja2.Environment() to mitigate the risk of arbitrary code execution. This change would help prevent the exploitation of the flaw by sandboxing the execution of templates.
Immediate Actions
Containment
- 1.Review all instances of SGLang in your environment.
- 2.Ensure that any model files loaded into SGLang are from trusted sources.
Remediation
Conclusion
CVE-2026-5760 is a critical vulnerability that poses a significant threat to systems using SGLang. Organizations must take immediate action to secure their environments and mitigate potential risks associated with this flaw.
🔒 Pro insight: This vulnerability highlights the risks of using template engines without proper sandboxing, which can lead to severe RCE threats.
