Executive brief
SGLang is an open-source framework used to serve large language models (LLMs). A vulnerability in its reranking component allows an attacker to execute arbitrary commands on the server by tricking a user into loading a malicious AI model file. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of AI services.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in SGLang's reranking endpoint (/v1/rerank). The root cause is located in `python/sglang/srt/entrypoints/openai/serving_rerank.py`, where the `_get_jinja_env` function initializes a `jinja2.Environment()` without sandboxing. An attacker can craft a GGUF model file with a malicious `tokenizer.chat_template` containing Jinja2 payloads (e.g., using `lipsum.__globals__['os'].popen()`). When a victim loads this model and the reranking endpoint is triggered, the payload executes arbitrary Python code in the context of the server process. This vulnerability is similar to the 'Llama Drama' (CVE-2024-34359) flaw. The issue is fixed in version 0.5.11 by migrating to `ImmutableSandboxedEnvironment`.
Affected products
- LMSYS SGLang up to (excluding) 0.5.11
Timeline
- 2026-04-07: other: Vendor notified by CERT/CC
- 2026-04-20: disclosed: Vulnerability details made public
- 2026-04-20: advisory: NVD and CERT/CC advisories published
- 2026-04-29: patched: Fix merged into SGLang main branch