PYSEC-2026-539
Vulnerability from pysec - Published: 2026-06-29 11:50 - Updated: 2026-07-01 20:23
VLAI?
Details
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.
Severity ?
9.8 (Critical)
Impacted products
| Name | purl | sglang | pkg:pypi/sglang |
|---|
Aliases
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.5.9"
},
"package": {
"ecosystem": "PyPI",
"name": "sglang",
"purl": "pkg:pypi/sglang"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.10"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.10",
"0.1.11",
"0.1.12",
"0.1.13",
"0.1.14",
"0.1.15",
"0.1.16",
"0.1.17",
"0.1.18",
"0.1.19",
"0.1.20",
"0.1.21",
"0.1.22",
"0.1.24",
"0.1.25",
"0.1.26",
"0.1.3",
"0.1.4",
"0.1.5",
"0.1.6",
"0.1.7",
"0.1.9",
"0.2.0",
"0.2.1",
"0.2.10",
"0.2.11",
"0.2.12",
"0.2.13",
"0.2.14",
"0.2.14.post1",
"0.2.14.post2",
"0.2.15",
"0.2.2",
"0.2.3",
"0.2.4",
"0.2.5",
"0.2.6",
"0.2.7",
"0.2.8",
"0.2.9",
"0.2.9.post1",
"0.3.0",
"0.3.1",
"0.3.1.post1",
"0.3.1.post2",
"0.3.1.post3",
"0.3.2",
"0.3.3",
"0.3.3.post1",
"0.3.4",
"0.3.4.post1",
"0.3.4.post2",
"0.3.5",
"0.3.5.post1",
"0.3.5.post2",
"0.3.6",
"0.3.6.post1",
"0.3.6.post2",
"0.3.6.post3",
"0.4.0",
"0.4.0.post1",
"0.4.0.post2",
"0.4.1",
"0.4.1.post1",
"0.4.1.post2",
"0.4.1.post3",
"0.4.1.post4",
"0.4.1.post5",
"0.4.1.post6",
"0.4.1.post7",
"0.4.10",
"0.4.10.post1",
"0.4.10.post2",
"0.4.2",
"0.4.2.post1",
"0.4.2.post2",
"0.4.2.post3",
"0.4.2.post4",
"0.4.3",
"0.4.3.post1",
"0.4.3.post2",
"0.4.3.post3",
"0.4.3.post4",
"0.4.4",
"0.4.4.post1",
"0.4.4.post2",
"0.4.4.post3",
"0.4.4.post4",
"0.4.5",
"0.4.5.post1",
"0.4.5.post2",
"0.4.5.post3",
"0.4.6",
"0.4.6.post1",
"0.4.6.post2",
"0.4.6.post3",
"0.4.6.post4",
"0.4.6.post5",
"0.4.7",
"0.4.7.post1",
"0.4.8",
"0.4.8.post1",
"0.4.9",
"0.4.9.post1",
"0.4.9.post2",
"0.4.9.post3",
"0.4.9.post4",
"0.4.9.post5",
"0.4.9.post6",
"0.5.0rc0",
"0.5.0rc1",
"0.5.0rc2",
"0.5.1",
"0.5.1.post1",
"0.5.1.post2",
"0.5.1.post3",
"0.5.10rc0",
"0.5.2",
"0.5.2rc0",
"0.5.2rc1",
"0.5.2rc2",
"0.5.3",
"0.5.3.post1",
"0.5.3.post2",
"0.5.3.post3",
"0.5.3rc0",
"0.5.3rc2",
"0.5.4",
"0.5.4.post1",
"0.5.4.post2",
"0.5.4.post3",
"0.5.5",
"0.5.5.post1",
"0.5.5.post2",
"0.5.5.post3",
"0.5.6",
"0.5.6.post1",
"0.5.6.post2",
"0.5.7",
"0.5.8",
"0.5.8.post1",
"0.5.9"
]
}
],
"aliases": [
"CVE-2026-3059",
"GHSA-rgq9-fqf5-fv58"
],
"details": "SGLang\u0027s multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.",
"id": "PYSEC-2026-539",
"modified": "2026-07-01T20:23:05.016272Z",
"published": "2026-06-29T11:50:45.317059Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/security/advisories/GHSA-3cp7-c6q2-94xr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3059"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/pull/20904"
},
{
"type": "PACKAGE",
"url": "https://github.com/sgl-project/sglang"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/blob/main/python/sglang/multimodal_gen/runtime/scheduler_client.py"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/releases/tag/v0.5.10"
},
{
"type": "WEB",
"url": "https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/sglang"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-rgq9-fqf5-fv58"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "SGLang\u0027s multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…