CyberRota Analysis
AI-GeneratedThe vulnerability in SGLang allows unauthenticated remote code execution through a bypass of the SafeUnpickler's denylist, enabling attackers to execute arbitrary commands via specially crafted base64-encoded pickle payloads. Organizations using SGLang should prioritize patching this critical flaw, as it poses a significant risk of exploitation that could lead to unauthorized access and control over affected systems. Immediate action is recommended for all users of this software to mitigate potential attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.
Related CVEs
Other vulnerabilities affecting the same vendor(s)