Skip to content
OpenAdvisories

Package · PyPI

sglang

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.8
    CVE-2026-3989

    CVE-2026-3989

    SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the scrip…

    SGLang SGLang sglang PyPI
  • High 7.3
    CVE-2025-10164

    lmsys sglang update_weights_from_tensor main deserialization

    A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The manipulation of the argument serialized_named_tensors results in deserialization. The attack can be lau…

    lm-sys sglang sglang PyPI