AIKIDO-2026-312871
sglang is vulnerable to Deserialization of Untrusted Data
91
Critical Risk
This Affects:
sglangTL;DR
SGLang's expert-parallel backup subsystem binds a ZeroMQ PULL socket to a routable network interface and reads incoming messages using pickle-based deserialization. The socket enforces no authentication and no deserialization safeguards, so any host that can reach the port can submit a crafted pickle payload. Deserializing that payload runs untrusted input as Python objects and executes arbitrary code in the context of the SGLang process, yielding unauthenticated remote code execution when the elastic expert-parallel feature is enabled and the port is network reachable. The upstream remediation adds a msgpack-native inter-process transport and a switch to stop deserializing untrusted socket data with pickle.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the elastic expert-parallel backup feature with its ZeroMQ socket reachable from an untrusted network.
Background info
sglang is vulnerable to Deserialization of Untrusted Data in versions 0.5.10 - 0.5.14.
How to fix this
Upgrade the sglang library to the patch version and set SGLANG_USE_PICKLE_IPC=0 so expert-backup IPC uses msgpack instead of pickle.
Links
GitHub Release
Other
vince.cert.org/vuls/id/326070
github.com/sgl-project/sglang/blob/main/python/sglang/srt/elastic_ep/expert_backup_manager.pykb.cert.org/vuls/id/326070
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant