Description
SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will be deserialized without validation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SGLang | SGLang | 5.10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | sglang | >= 0.4.1.post7, <= 0.5.12 | — | GHSA-36m8-w8qf-g76p |