Is CVE-2026-5760 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5760 being exploited in the wild.

How severe is CVE-2026-5760?

Critical severity, with a CVSS score of 9.8, published 20 April 2026.

Which products and versions are affected?

LMSYS SGLang up to (excluding) 0.5.11.

Is there a fix for CVE-2026-5760?

A patch was published on 2026-04-29: Fix merged into SGLang main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5760 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5760?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5760: LMSYS SGLang RCE via unsandboxed Jinja2 template in rerank endpoint

CVE-2026-5760 · Severity: critical · CVSS 9.8 · Published 2026-04-20

SGLang is an open-source framework used to serve large language models (LLMs). A vulnerability in its reranking component allows an attacker to execute arbitrary commands on the server by tricking a user into loading a malicious AI model file. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of AI services.

Quick answers

Is CVE-2026-5760 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5760 being exploited in the wild.
How severe is CVE-2026-5760?: Critical severity, with a CVSS score of 9.8, published 20 April 2026.
Which products and versions are affected?: LMSYS SGLang up to (excluding) 0.5.11.
Is there a fix for CVE-2026-5760?: A patch was published on 2026-04-29: Fix merged into SGLang main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5760 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5760?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in SGLang's reranking endpoint (/v1/rerank). The root cause is located in `python/sglang/srt/entrypoints/openai/serving_rerank.py`, where the `_get_jinja_env` function initializes a `jinja2.Environment()` without sandboxing. An attacker can craft a GGUF model file with a malicious `tokenizer.chat_template` containing Jinja2 payloads (e.g., using `lipsum.__globals__['os'].popen()`). When a victim loads this model and the reranking endpoint is triggered, the payload executes arbitrary Python code in the context of the server process. This vulnerability is similar to the 'Llama Drama' (CVE-2024-34359) flaw. The issue is fixed in version 0.5.11 by migrating to `ImmutableSandboxedEnvironment`.

Affected products

LMSYS SGLang up to (excluding) 0.5.11

Timeline

2026-04-07: other: Vendor notified by CERT/CC
2026-04-20: disclosed: Vulnerability details made public
2026-04-20: advisory: NVD and CERT/CC advisories published
2026-04-29: patched: Fix merged into SGLang main branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.