AIKIDO-2026-756495
sglang is vulnerable to Deserialization of Untrusted Data
98
Critical Risk
This Affects:
sglangTL;DR
The multimodal generation runtime's disaggregated diffusion orchestrator binds an unauthenticated ZeroMQ ROUTER socket to a network interface. The DiffusionServer passes the final frame of received multipart messages directly to pickle.loads() before any validation. An unauthenticated peer that can reach this socket can trigger arbitrary code execution through a crafted pickle payload.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run SGLang's multimodal generation runtime with the disaggregated diffusion orchestrator's ROUTER socket reachable by untrusted peers.
Background info
sglang is vulnerable to Deserialization of Untrusted Data in versions 0.5.11 - 0.5.20.
How to fix this
No patched release is currently available; restrict access to the ROUTER socket to trusted peers.
Links
CVE Detail
Other
github.com/sgl-project/sglang/blob/main/python/sglang/multimodal_gen/runtime/disaggregation/orchestrator.py
hacchoomiso.github.io/blog/SGLang/CVE-2026-93088/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.