IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-03-12 12:15

MODIFIED

2026-03-12 12:15

EPSS (Prob. Exploit)

1.50%

Top 25.9%

DATA SOURCES:

NVD 🔗 2026-03-12 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-05 OSV 🔗 2026-07-26

> DESCRIPTION

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-rgq9-fqf5-fv58 CRITICAL

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker

AFFECTED PACKAGES:

PIP / sglang

<= 0.5.9

Fixed in: 0.5.10

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

CVE-2026-3059

AFFECTED PACKAGES:

Unknown / Unknown

12 versions affected

ALIASES:

GHSA-3cp7-c6q2-94xr, GHSA-rgq9-fqf5-fv58, PYSEC-2026-539

> HISTORIQUE DES MODIFICATIONS

Première apparition

12/03/2026 12:15

Source: NVD

Total des modifications: 0 Dernière mise à jour: 7 months ago

> REFERENCES

https://github.com/sgl-project/sglang/blob/main/python/sglang/multimodal_gen/run...

https://github.com/sgl-project/sglang/security/advisories/GHSA-3cp7-c6q2-94xr

https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities/