Description (CNA)
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SGLang / SGLang | affected 0 through v0.5.20 |
CWE
No CWE identifiers supplied.
References
- https://github.com/sgl-project/sglang/tree/main
- https://m00dy.sh/notes/disabling-pickle-did-not-remove-pickle?palette=mineral
ADP enrichment
No English description supplied.
No references supplied.