PT-2026-66561 · Sglang · Sglang
CVE-2026-15976
·
Published
2026-07-30
·
Updated
2026-07-30
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update weights from disk, where torch.load(..., weights only=False) fallback enables pickle deserialization of .bin files.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sglang