Skip to content

#sglang

2 articles

Security Alerts May 18, 2026

CVE-2026-7301: Unauthenticated RCE in SGLang multimodal runtime

SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when exposed to the interne...

Security Alerts May 18, 2026

CVE-2026-7304: Unauthenticated RCE in SGLang custom logit processor

SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will ...