Vulnerabilità · 162 giorni fa

Malicious Model Files Can Own SGLang Servers

A model file can become a server compromise path when the serving stack renders attacker-controlled template data. In SGLang, the standard assumption that a downloaded GGUF model is just data breaks at the /v1/rerank endpoint, where a crafted tokenizer.chat_template can execute arbitrary Python code.

CERT/CC says CVE-2026-5760 is a CVSS 9.8 command-injection flaw in SGLang that affects the reranking endpoint /v1/rerank. The issue lets a malicious GGUF model trigger remote code execution in the SGLang service context, and the reported fix is to use ImmutableSandboxedEnvironment instead of jinja2.Environment().

The broader risk is that model-serving platforms can share the same parsing mistake. If one malicious GGUF file can compromise one framework, similar template-rendering paths in other LLM-serving projects may expose the same attack surface.

Cronologia

• 21 apr Segnalato da The Hacker News

Fonti

1 fonte che coprono questa storia

• The Hacker News 21 apr

  SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files

  CVE-2026-5760 (CVSS 9.8) exposes SGLang via /v1/rerank endpoint, enabling RCE through malicious GGUF models, risking server compromise.

Entità

• CVE-2026-5760

Part of the PlainSec briefing for 2026-04-21

Editions

• Briefing for 2026-04-21

Storie correlate

• ActiveMQ Brokers Exposed to Active Exploitation at Scale
• Single Verifier Let Lazarus Forge Cross-Chain Messages
• Serial-to-IP Flaws Expose Legacy OT at Scale