# CVE-2026-7669: PYSEC-2026-3062 - SGLang has an Improper Input Validation/Injection Issue

Source: https://junglewise.ai/threats/cve-2026-7669-sglang-has-an-improper-input-validation-injection-issue  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-02  
License: CC BY 4.0 with a link back

CVE-2026-7669 · Severity: medium · CVSS 5.6 · Published 2026-05-02

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller's explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode="auto" and tokenizer_mode="slow" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Technologies: [sglang (PyPI)](https://junglewise.ai/threats/technologies/pypi-sglang). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-7669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7669 being exploited in the wild.

**How severe is CVE-2026-7669?** Medium severity, with a CVSS score of 5.6, published 2 May 2026.

**Which products and versions are affected?** sglang (PyPI) ECOSYSTEM:introduced=0,last_affected=0.5.9.

**Is there a fix for CVE-2026-7669?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-7669?** Check whether you run sglang (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- sglang (PyPI) ECOSYSTEM:introduced=0,last_affected=0.5.9

## Identifiers

- CVE-2026-7669
- GHSA-6m5f-673f-5vh7
- PYSEC-2026-3062

## Related threats

- [PYSEC-2026-1919 - SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor](https://junglewise.ai/threats/cve-2025-10164-sglang-remote-code-execution-vulnerability-via-unsafe)
- [SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker](https://junglewise.ai/threats/cve-2026-3059-sglang-s-multimodal-generation-module-is-vulnerable-to)
- [PYSEC-2026-537 - SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code…](https://junglewise.ai/threats/cve-2026-3060-sglang-s-encoder-parallel-disaggregation-system-is-vulnerable-to)
- [sgl-project SGLang denial of service in Cache Handler](https://junglewise.ai/threats/cve-2026-10775-sgl-project-sglang-denial-of-service-in-cache-handler)
- [SGLang reachable assertion in LoRA manager scheduler admission](https://junglewise.ai/threats/cve-2026-10300-sglang-reachable-assertion-in-lora-manager-scheduler-admission)