Executive brief
SGLang, an open-source framework for serving large language AI models, contains a critical security flaw in its multimodal generation component. The software's internal communication system is exposed to the network by default and processes incoming data insecurely. An attacker can exploit this to gain full control over the server running the AI model, potentially leading to data theft, service disruption, or unauthorized access to corporate infrastructure.
Technical details
A deserialization vulnerability (CWE-502) exists in the SGLang multimodal generation runtime scheduler. The scheduler utilizes a ZeroMQ ROUTER socket that, while defaulting to localhost in code, is frequently bound to 0.0.0.0 in official deployment configurations (Docker, SkyPilot, AWS SageMaker). The 'scheduler.py' component invokes 'pickle.loads()' on the payload of incoming multipart messages without prior validation. An unauthenticated remote attacker can send a crafted Python pickle object to the exposed port to achieve arbitrary code execution with the privileges of the SGLang process. As of the advisory date, no official patch is available; users are advised to restrict network access to SGLang interfaces.
Affected products
- SGLang Project sglang >= 0.5.5, <= 0.5.12
Timeline
- 2026-03-10: disclosed: Responsibly disclosed to SGLang maintainers by Antiproof
- 2026-05-18: advisory: Published to GitHub Advisory Database and NVD