Vulnerability-Lookup

PYSEC-2026-3062

Vulnerability from pysec - Published: 2026-07-13 15:02 - Updated: 2026-07-13 16:06

Details

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

5.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Impacted products

Name	purl
sglang	pkg:pypi/sglang

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sglang",
        "purl": "pkg:pypi/sglang"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.5.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.10",
        "0.1.11",
        "0.1.12",
        "0.1.13",
        "0.1.14",
        "0.1.15",
        "0.1.16",
        "0.1.17",
        "0.1.18",
        "0.1.19",
        "0.1.20",
        "0.1.21",
        "0.1.22",
        "0.1.24",
        "0.1.25",
        "0.1.26",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.1.9",
        "0.2.0",
        "0.2.1",
        "0.2.10",
        "0.2.11",
        "0.2.12",
        "0.2.13",
        "0.2.14",
        "0.2.14.post1",
        "0.2.14.post2",
        "0.2.15",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.5",
        "0.2.6",
        "0.2.7",
        "0.2.8",
        "0.2.9",
        "0.2.9.post1",
        "0.3.0",
        "0.3.1",
        "0.3.1.post1",
        "0.3.1.post2",
        "0.3.1.post3",
        "0.3.2",
        "0.3.3",
        "0.3.3.post1",
        "0.3.4",
        "0.3.4.post1",
        "0.3.4.post2",
        "0.3.5",
        "0.3.5.post1",
        "0.3.5.post2",
        "0.3.6",
        "0.3.6.post1",
        "0.3.6.post2",
        "0.3.6.post3",
        "0.4.0",
        "0.4.0.post1",
        "0.4.0.post2",
        "0.4.1",
        "0.4.1.post1",
        "0.4.1.post2",
        "0.4.1.post3",
        "0.4.1.post4",
        "0.4.1.post5",
        "0.4.1.post6",
        "0.4.1.post7",
        "0.4.10",
        "0.4.10.post1",
        "0.4.10.post2",
        "0.4.2",
        "0.4.2.post1",
        "0.4.2.post2",
        "0.4.2.post3",
        "0.4.2.post4",
        "0.4.3",
        "0.4.3.post1",
        "0.4.3.post2",
        "0.4.3.post3",
        "0.4.3.post4",
        "0.4.4",
        "0.4.4.post1",
        "0.4.4.post2",
        "0.4.4.post3",
        "0.4.4.post4",
        "0.4.5",
        "0.4.5.post1",
        "0.4.5.post2",
        "0.4.5.post3",
        "0.4.6",
        "0.4.6.post1",
        "0.4.6.post2",
        "0.4.6.post3",
        "0.4.6.post4",
        "0.4.6.post5",
        "0.4.7",
        "0.4.7.post1",
        "0.4.8",
        "0.4.8.post1",
        "0.4.9",
        "0.4.9.post1",
        "0.4.9.post2",
        "0.4.9.post3",
        "0.4.9.post4",
        "0.4.9.post5",
        "0.4.9.post6",
        "0.5.0rc0",
        "0.5.0rc1",
        "0.5.0rc2",
        "0.5.1",
        "0.5.1.post1",
        "0.5.1.post2",
        "0.5.1.post3",
        "0.5.2",
        "0.5.2rc0",
        "0.5.2rc1",
        "0.5.2rc2",
        "0.5.3",
        "0.5.3.post1",
        "0.5.3.post2",
        "0.5.3.post3",
        "0.5.3rc0",
        "0.5.3rc2",
        "0.5.4",
        "0.5.4.post1",
        "0.5.4.post2",
        "0.5.4.post3",
        "0.5.5",
        "0.5.5.post1",
        "0.5.5.post2",
        "0.5.5.post3",
        "0.5.6",
        "0.5.6.post1",
        "0.5.6.post2",
        "0.5.7",
        "0.5.8",
        "0.5.8.post1",
        "0.5.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-7669",
    "GHSA-6m5f-673f-5vh7"
  ],
  "details": "A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "PYSEC-2026-3062",
  "modified": "2026-07-13T16:06:17.328054Z",
  "published": "2026-07-13T15:02:56.168010Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gouldnicholas/CVE-2026-7669-PoC"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sgl-project/sglang"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/799263"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/360817"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/360817/cti"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/sglang"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-6m5f-673f-5vh7"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "SGLang has an Improper Input Validation/Injection Issue"
}

CVE-2026-7669 (GCVE-0-2026-7669)

Vulnerability from cvelistv5 – Published: 2026-05-02 22:00 – Updated: 2026-05-05 00:31

Title

sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection

Summary

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller's explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode="auto" and tokenizer_mode="slow" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

5.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

5.6 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-05 00:31 UTC

CWE

CWE-94 - Code Injection
CWE-74 - Injection

Assigner

VulDB mitre root

References

4 references

URL	Tags
https://vuldb.com/vuln/360817	vdb-entrytechnical-descriptionexploit
https://vuldb.com/vuln/360817/cti	signaturepermissions-required
https://vuldb.com/submit/799263	third-party-advisory
https://github.com/gouldnicholas/CVE-2026-7669-PoC	exploit

Impacted products

1 product

Vendor	Product	Version
sgl-project	SGLang	Affected: 0.5.0 Affected: 0.5.1 Affected: 0.5.2 Affected: 0.5.3 Affected: 0.5.4 Affected: 0.5.5 Affected: 0.5.6 Affected: 0.5.7 Affected: 0.5.8 Affected: 0.5.9

Credits

Nicholas Gould David Rochester ngould (VulDB User) ngould (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7669",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-05T00:31:25.310003Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-05T00:31:40.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "HuggingFace Transformer Handler"
          ],
          "product": "SGLang",
          "vendor": "sgl-project",
          "versions": [
            {
              "status": "affected",
              "version": "0.5.0"
            },
            {
              "status": "affected",
              "version": "0.5.1"
            },
            {
              "status": "affected",
              "version": "0.5.2"
            },
            {
              "status": "affected",
              "version": "0.5.3"
            },
            {
              "status": "affected",
              "version": "0.5.4"
            },
            {
              "status": "affected",
              "version": "0.5.5"
            },
            {
              "status": "affected",
              "version": "0.5.6"
            },
            {
              "status": "affected",
              "version": "0.5.7"
            },
            {
              "status": "affected",
              "version": "0.5.8"
            },
            {
              "status": "affected",
              "version": "0.5.9"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nicholas Gould"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "David Rochester"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "ngould (VulDB User)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "ngould (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller\u0027s explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode=\"auto\" and tokenizer_mode=\"slow\" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.1,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-04T04:21:53.695Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-360817 | sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection",
          "tags": [
            "vdb-entry",
            "technical-description",
            "exploit"
          ],
          "url": "https://vuldb.com/vuln/360817"
        },
        {
          "name": "VDB-360817 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/360817/cti"
        },
        {
          "name": "Submit #799263 | sgl-project sglang \u003c=0.5.9 Protection Mechanism Failure",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/799263"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/gouldnicholas/CVE-2026-7669-PoC"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-07T02:00:00.000Z",
          "value": "Vulnerability found"
        },
        {
          "lang": "en",
          "time": "2026-04-07T02:00:00.000Z",
          "value": "Vendor informed"
        },
        {
          "lang": "en",
          "time": "2026-05-02T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-05-02T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-05-03T02:00:00.000Z",
          "value": "Exploit disclosed"
        },
        {
          "lang": "en",
          "time": "2026-05-04T06:26:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-7669",
    "datePublished": "2026-05-02T22:00:19.859Z",
    "dateReserved": "2026-05-02T08:00:13.701Z",
    "dateUpdated": "2026-05-05T00:31:40.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-6M5F-673F-5VH7

Vulnerability from github – Published: 2026-05-03 00:31 – Updated: 2026-05-07 21:09

Summary

SGLang has an Improper Input Validation/Injection Issue

Details

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

5.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sglang"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.5.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-7669"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T21:09:28Z",
    "nvd_published_at": "2026-05-02T22:16:24Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-6m5f-673f-5vh7",
  "modified": "2026-05-07T21:09:29Z",
  "published": "2026-05-03T00:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gouldnicholas/CVE-2026-7669-PoC"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sgl-project/sglang"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/799263"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/360817"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/360817/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "SGLang has an Improper Input Validation/Injection Issue"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

PYSEC-2026-3062

CVE-2026-7669 (GCVE-0-2026-7669)

GHSA-6M5F-673F-5VH7

Tags

Sightings

Nomenclature

Related by attack behaviour