CVE-2026-5760: 
SGLang vulnerability analysis and mitigation

CVE-2026-5760 is a critical Remote Code Execution (RCE) vulnerability in SGLang's reranking endpoint (/v1/rerank), caused by unsandboxed Jinja2 template rendering of model-supplied tokenizer.chat_template fields. It affects SGLang versions prior to 0.5.11 (vendor lmsys/sglang). The vulnerability was publicly disclosed on April 20, 2026, with a CERT/CC advisory (VU#915947) published the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, CERT/CC).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). In python/sglang/srt/entrypoints/openai/serving_rerank.py, the _get_jinja_env() function instantiates a bare jinja2.Environment() instead of the sandboxed jinja2.sandbox.ImmutableSandboxedEnvironment, allowing arbitrary Python code execution via Server-Side Template Injection (SSTI). An attacker crafts a malicious GGUF model file embedding a Jinja2 SSTI payload in the tokenizer.chat_template metadata field, along with a Qwen3 reranker trigger phrase (The answer can only be "yes" or "no".) to activate the vulnerable code path. When the victim loads this model and any request hits /v1/rerank, the template is rendered without restriction, executing attacker-controlled OS commands via lipsum.__globals__["os"].popen(). No authentication or special privileges are required (CERT/CC, PoC Repo, SGLang PR).

Successful exploitation grants an unauthenticated remote attacker arbitrary code execution in the context of the SGLang service process, resulting in full confidentiality, integrity, and availability compromise of the affected server. This can lead to host compromise, lateral movement within the network, exfiltration of sensitive data (including model weights, API keys, or training data), and denial-of-service. Deployments that expose the /v1/rerank endpoint to untrusted networks — including public-facing AI inference servers — are at the highest risk (CERT/CC, Github Advisory).

A functional, high-confidence public proof-of-concept exploit (exploit.py) is available on GitHub, authored by researcher Stuart Beck (Stuub), which generates a malicious GGUF file and demonstrates arbitrary command execution against a live SGLang server (PoC Repo). Exploitation has been reported across multiple sources including hackerworkspace.com, and the vulnerability received broad media coverage shortly after disclosure (Github Advisory). The EPSS score is approximately 0.38–0.58% (69th percentile), indicating moderate near-term exploitation probability. No CISA KEV catalog listing or confirmed in-the-wild threat actor attribution has been identified at this time. The vulnerability shares the same class as CVE-2024-34359 ("Llama Drama" in llama-cpp-python), indicating a known and repeatable attack pattern in AI inference frameworks.

1. Craft malicious GGUF model: Use the public PoC (exploit.py) or manually create a GGUF model file (e.g., with the gguf Python library) targeting the qwen3 architecture, embedding a malicious Jinja2 SSTI payload in the tokenizer.chat_template field. The payload must include the Qwen3 reranker trigger phrase: The answer can only be "yes" or "no". followed by {{ lipsum.__globals__["os"].popen("<command>").read() }}.
2. Distribute the malicious model: Host the crafted GGUF file on a public model repository (e.g., HuggingFace) or deliver it via social engineering to a target who operates an SGLang inference server.
3. Wait for model loading: The victim downloads and loads the malicious GGUF model into their SGLang instance (e.g., via python -m sglang.launch_server --model-path ./malicious_reranker.gguf).
4. Trigger the vulnerable endpoint: Send any HTTP request to the /v1/rerank endpoint of the SGLang server. The trigger phrase in the template activates the Qwen3 reranker code path in serving_rerank.py, causing _render_jinja_chat_template() to render the malicious template with the unsandboxed jinja2.Environment().
5. Achieve RCE: The SSTI payload executes the attacker's OS command on the server as the SGLang service account, enabling reverse shell establishment, data exfiltration, or further lateral movement (PoC Repo, CERT/CC).

• Network: Unexpected outbound connections from the SGLang server process to external IPs (e.g., reverse shell callbacks); HTTP requests to /v1/rerank from untrusted or external sources loading newly introduced model files.
• File System: Presence of unexpected .gguf files with qwen3 architecture and unusual tokenizer.chat_template metadata containing Jinja2 syntax (e.g., {{, lipsum, __globals__, os.popen); new files written by the SGLang process in unexpected directories.
• Process: Unusual child processes spawned by the SGLang Python process (e.g., /bin/sh, bash, curl, wget, python3) executing OS commands; processes running under the SGLang service account performing network connections.
• Logs: SGLang server logs showing requests to /v1/rerank coinciding with model load events for unfamiliar GGUF files; Python tracebacks or output containing strings like SGLANG_RCE_CONFIRMED or unexpected command output in template rendering logs (PoC Repo, CERT/CC).

Upgrade SGLang to version 0.5.11 or later, which replaces the unsandboxed jinja2.Environment() with jinja2.sandbox.ImmutableSandboxedEnvironment() in serving_rerank.py (merged via PR #23660 on April 29, 2026) (SGLang PR). As a workaround for those unable to upgrade immediately, restrict network access to the /v1/rerank endpoint using firewall rules or API gateway authentication, and only load model files from trusted, verified sources. Additionally, implement strict validation and integrity checking of GGUF model files before loading, and monitor for suspicious model loading activity (CERT/CC).

The vulnerability received significant media coverage shortly after disclosure on April 20, 2026, with articles from The Hacker News, GBHackers, CyberSecurityNews, and SecurityOnline highlighting the risk of malicious GGUF model files in AI inference pipelines (The Hacker News). CERT/CC published a formal vulnerability note (VU#915947) and noted that no response was received from SGLang project maintainers during the initial coordination period, though a community-contributed fix was ultimately merged (CERT/CC). The vulnerability was discussed on Reddit (r/SecOpsDaily), Mastodon, and Bluesky, with community commentary drawing parallels to CVE-2024-34359 ("Llama Drama") and highlighting the broader risk of unsandboxed template rendering in AI/ML serving frameworks. Red Hat also published a CVE tracking entry, indicating awareness across enterprise Linux ecosystems.