SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files
Summary: A critical command injection flaw in SGLang, tracked as CVE-2026-5760 and scored 9.8 out of 10.0, allows remote code execution through the "/v1/rerank" endpoint when a victim loads a malicious GGUF model file whose crafted tokenizer.chat_template parameter carries a Jinja2 server-side template injection payload. CERT/CC said the flaw stems from using jinja2.Environment() without sandboxing instead of ImmutableSandboxedEnvironment, and that no response or patch was obtained during the coordination process.
Why it matters: The project has been forked over 5,500 times and starred 26,100 times, and there is no patch - so every deployment that loads a model from an untrusted source is running the vulnerable code path until operators switch to ImmutableSandboxedEnvironment themselves.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-34359CVE-2025-61620CVE-2026-5760
- Related
- ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026