SGLang contains an unauthenticated RCE in /loadloraadapterfromtensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPERSERVERPORT is set, enabling code execution on inference requests.

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services.

SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /updateweightsfromdisk, where torch.load(..., weightsonly=False) fallback enables pickle deserialization of .bin files.

SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.