A model file can become a server compromise path when the serving stack renders attacker-controlled template data. In SGLang, the standard assumption that a downloaded GGUF model is just data breaks at the /v1/rerank endpoint, where a crafted tokenizer.chat_template can execute arbitrary Python code.
CERT/CC says CVE-2026-5760 is a CVSS 9.8 command-injection flaw in SGLang that affects the reranking endpoint /v1/rerank. The issue lets a malicious GGUF model trigger remote code execution in the SGLang service context, and the reported fix is to use ImmutableSandboxedEnvironment instead of jinja2.Environment().
The broader risk is that model-serving platforms can share the same parsing mistake. If one malicious GGUF file can compromise one framework, similar template-rendering paths in other LLM-serving projects may expose the same attack surface.