Executive brief
SGLang, an open-source framework for serving Large Language Models (LLMs), contains a vulnerability that allows for remote code execution. The flaw exists in how the system handles model weight updates from external sources like HuggingFace. If an attacker can reach the server's management interface, they can force the system to load a malicious file that executes arbitrary commands on the underlying server, potentially leading to a full system takeover and data theft.
Technical details
A remote code execution vulnerability exists in SGLang versions up to and including v0.5.15. The vulnerability is located within the `/update_weights_from_disk` endpoint, which is used to load or update model weights from disk or HuggingFace repositories. When processing `.bin` files, the application utilizes `torch.load()` with the `weights_only=False` fallback enabled. This configuration allows for the deserialization of arbitrary Python objects via the `pickle` module. An attacker who can reach this administrative route—which may be unauthenticated if API keys are not explicitly configured—can provide a malicious legacy checkpoint file to achieve arbitrary code execution in the context of the server process.
Affected products
- SGLang Project SGLang <= v0.5.15
Timeline
- 2026-04-22: disclosed: Initial disclosure to maintainers via GitHub Security Advisories
- 2026-07-30: advisory: Public disclosure via CERT/CC and NVD