{"metadata": {"vulnerability": "CVE-2026-111391", "count": 18, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111391", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-15T21:55:44.538Z", "date_only": false, "value": "2026-10-15T21:55:44.538Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111391", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T11:41:52.009Z", "date_only": false, "value": "2026-10-16T11:41:52.009Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111391", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T11:41:52.009Z", "date_only": false, "value": "2026-10-16T11:41:52.009Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111391", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T11:48:28.405Z", "date_only": false, "value": "2026-10-16T11:48:28.405128Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117450428112408799", "record": "CVE-2026-111391", "field": "creation_timestamp", "uuid": "1fb0a927-46f0-4114-822f-4b0a06320b4f", "content": "CVE-2026-111391 SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111391https://github.com/sgl-project/sglang/issues/44188https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/debug_utils/dumper.py#L1309-L1320https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/debug_utils/dumper.py#L1380-L1401https://github.com/sgl-project/sglanghttps://www.vulncheck.com/advisories/sglang-0.5.10-through-0.5.22-code-injection-via-debug-dumper-filter#sgl-project #sglang#CVE_2026_111391#bot", "url": "https://infosec.exchange/users/cve/statuses/117450428112408799"}, {"timestamp": "2026-10-16T12:00:26.815Z", "date_only": false, "value": "2026-10-16T12:00:26.815036Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117450475183045212", "record": "cve-2026-111391", "field": "creation_timestamp", "uuid": "2cd1fa1c-c0db-447a-b09d-e07b65debd54", "content": "sgl-project sglang (0.5.10 \u2013 0.5.22) is affected by a CRITICAL eval injection (CVE-2026-111391, CVSS 9.2). Remote RCE is possible via /dumper/configure if DUMPER_SERVER_PORT is set. Patch ASAP! https://radar.offseq.com/threat/cve-2026-111391-improper-neutralization-of-directives-in-dynamically-evaluated-code-eval-injection-in-f8a10e538b599ada #OffSeq #CVE2026111391 #Python #Security", "url": "https://infosec.exchange/users/offseq/statuses/117450475183045212"}, {"timestamp": "2026-10-16T12:00:28.473Z", "date_only": false, "value": "2026-10-16T12:00:28.473705Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxyjojpa2f2q", "record": "cve-2026-111391", "field": "creation_timestamp", "uuid": "d6aed286-bb03-4664-995e-4949b548c61b", "content": "sgl-project sglang 0.5.10 \u2013 0.5.22 hit by CRITICAL eval injection (CVE-2026-111391). Remote code execution possible if DUMPER_SERVER_PORT is active. Patch or restrict access now. https://radar.offseq.com/threat/cve-2026-111391-improper-neutralization-of-directives-in-dynamically-evaluated-code-ev...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxyjojpa2f2q"}, {"timestamp": "2026-10-16T12:16:33Z", "date_only": false, "value": "2026-10-16T12:16:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VFGJ-P7F7-R3V8", "record": "GHSA-VFGJ-P7F7-R3V8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T12:16:33.197Z", "date_only": false, "value": "2026-10-16T12:16:33.197", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111391", "record": "FKIE_CVE-2026-111391", "field": "published"}, {"timestamp": "2026-10-16T12:31:22Z", "date_only": false, "value": "2026-10-16T12:31:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VFGJ-P7F7-R3V8", "record": "GHSA-VFGJ-P7F7-R3V8", "field": "published"}, {"timestamp": "2026-10-16T12:31:22Z", "date_only": false, "value": "2026-10-16T12:31:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VFGJ-P7F7-R3V8", "record": "GHSA-VFGJ-P7F7-R3V8", "field": "modified"}, {"timestamp": "2026-10-16T13:48:49.265Z", "date_only": false, "value": "2026-10-16T13:48:49.265991Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111391", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T13:48:49.265Z", "date_only": false, "value": "2026-10-16T13:48:49.265991Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111391", "record": "FKIE_CVE-2026-111391", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T13:52:52.818Z", "date_only": false, "value": "2026-10-16T13:52:52.818Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111391", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T13:52:52.818Z", "date_only": false, "value": "2026-10-16T13:52:52.818Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111391", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:07:10.530Z", "date_only": false, "value": "2026-10-16T14:07:10.530438Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxyqr3xm2p2l", "record": "CVE-2026-111391", "field": "creation_timestamp", "uuid": "936220f4-e6e9-4467-bd96-341a89e1d347", "content": "\ud83d\udea8 CVE-2026-111391 \u2014 CVSS 9.2 CRITICAL\n\nSGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111391\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxyqr3xm2p2l"}, {"timestamp": "2026-10-16T14:17:23.290Z", "date_only": false, "value": "2026-10-16T14:17:23.290", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111391", "record": "FKIE_CVE-2026-111391", "field": "lastModified"}, {"timestamp": "2026-10-16T14:20:05.770Z", "date_only": false, "value": "2026-10-16T14:20:05.770547Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxyri6k4jd2q", "record": "CVE-2026-111391", "field": "creation_timestamp", "uuid": "066c7c0e-7f52-4f0d-b96a-a5e51b3a3604", "content": "CVE-2026-111391 - sglang\nVersions 0.5.10 to 0.5.22 of SGLang can be tricked into executing arbitrary Python code when an unauthenticated user sends a specially crafted filter to the /dumper/configure URL.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sglang #sglproject #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxyri6k4jd2q"}]}