← CVE Intelligence

CVE-2026-5760

CVE-2026-5760 PUBLISHED

Description (CNA)

SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().

Affected (CNA)

Vendor / productVersions
SGLang / SGLangaffected 8f3097e

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.