PT-2025-45697 · Pypi · Sglang

Publicado 2025-09-09 · Atualizado 2025-09-09

OSV

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update weights from tensor. The manipulation of the argument serialized named tensors results in deserialization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Correção

Deserialization of Untrusted Data

RCE

Enumeração de Fraquezas

CWE-502

CWE-20

Identificadores relacionados

GHSA-9W53-XR52-MWGJ

Produtos afetados

Sglang

Referências · 7

• https://github.com/sgl-project/sglang · Nota
• https://github.com/sgl-project/sglang/commit/49afb3d9d9deedf6dea3a6dd5c50e85e7d8bcb07 · Nota
• https://vuldb.com/?submit.635919 · Nota
• https://vuldb.com/?id.323203 · Nota
• https://vuldb.com/?ctiid.323203 · Nota
• https://osv.dev/vulnerability/GHSA-9w53-xr52-mwgj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-10164 · Nota de Segurança