AIKIDO-2025-10388
sglang is vulnerable to Exposure of Resource to Wrong Sphere
88
High Risk
This Affects:
sglangTL;DR
Affected versions of this package do not restrict the MessageQueue component from binding to all available TCP interfaces (e.g., 0.0.0.0), which exposes the service to external network access by default. This can increase the attack surface, especially if the message queue is intended for internal use only. Without proper binding to a loopback address (e.g., 127.0.0.1) or explicit configuration, remote attackers may be able to interact with or exploit the message queue service, potentially leading to unauthorized access, data leakage, or further attacks depending on the queue’s capabilities and access controls.
Who does this affect?
You are affected if you are using a version of this package 0.4.7.
Background info
sglang is vulnerable to Exposure of Resource to Wrong Sphere in versions 0.4.0 - 0.4.6.post5.
How to fix this
Upgrade the sglang library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant