- A critical vulnerability (CVE-2026-5760) with a CVSS score of 9.8 allows remote code execution in the SGLang framework.
- The flaw is in the “/v1/rerank” endpoint and is exploited via a malicious GGUF model file containing a Jinja2 template injection payload.
- Security researcher Stuart Beck discovered the issue, which stems from using jinja2.Environment() without proper sandboxing.
- The vulnerability is similar to past flaws in other AI serving packages, such as CVE-2024-34359 and CVE-2025-61620.
- The CERT Coordination Center recommends using ImmutableSandboxedEnvironment to mitigate the risk, as no official patch was provided during coordination.
On April 20, 2026, security researcher Ravie Lakshmanan reported a severe remote code execution flaw in the open-source SGLang framework, a popular tool for serving large language models. The vulnerability, officially tracked as CVE-2026-5760, carries a maximum severity CVSS score of 9.8.
According to the CERT Coordination Center (CERT/CC), the flaw specifically impacts the reranking endpoint “/v1/rerank.” Consequently, an attacker can achieve arbitrary code execution by tricking a server into loading a specially crafted GGUF model file.
The advisory said “An attacker exploits this vulnerability by creating a malicious GPT Generated Unified Format (GGUF) model file with a crafted tokenizer.chat_template parameter that contains a Jinja2 server-side template injection (SSTI) payload.” This payload executes when the vulnerable endpoint processes a request.
Researcher Stuart Beck, who discovered and reported the flaw, identified the root cause as the unsafe use of jinja2.Environment(). Meanwhile, this vulnerability class mirrors previously patched issues in similar AI infrastructure, like CVE-2024-34359.
To mitigate the risk, CERT/CC recommends replacing the vulnerable code with ImmutableSandboxedEnvironment. However, no official patch was obtained from the project maintainers during the vulnerability coordination process.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
