GitHub Advisoryadvisory · PyPI

GHSA-gwv6-pq6m-p3rq SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket

CRITICAL Published 2026-05-18 Modified 2026-05-29 Official page ↗

Aliases: CVE-2026-7301
Ecosystem: PyPI
Packages: sglang
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-502
Reviewed: 2026-05-29

Affected packages

• PyPI sglang: >= 0.5.5, <= 0.5.12 (no fix yet)

Description

SGLang's multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when exposed to the internet.

Alias · CVE (1)

CVE-2026-7301 SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads()… vulnerability

Weakness · CWE (1)

CWE-502 Deserialization of Untrusted Data weakness

References