PT-2026-33769 · Sglang · Sglang

Ccullen-Cert

·

Published

2026-04-20

·

Updated

2026-04-29

·

CVE-2026-5760

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SGLang (affected versions not specified)
Description An issue in the '/v1/rerank' endpoint allows remote code execution when a model file containing a malicious tokenizer.chat template is loaded. This occurs because Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment(), leading to server-side template injection (SSTI). An attacker can craft a malicious GPT-Generated Unified Format (GGUF) model file with an SSTI payload and upload it to public repositories. When a victim integrates this model and an unauthenticated POST request is sent to the '/v1/rerank' endpoint, arbitrary Python code is executed on the server host with the privileges of the SGLang service. This issue has been reported as being actively exploited in the wild.
Recommendations Replace jinja2.Environment() with jinja2.sandbox.ImmutableSandboxedEnvironment() in all template rendering components within the SGLang source code. Avoid loading models from untrusted or unverified sources. Restrict internet access for inference servers to prevent unauthorized requests to the '/v1/rerank' endpoint.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-05925
CVE-2026-5760

Affected Products

Sglang