CRITICAL 9.8

PYSEC-2026-535

SGLang: Unauthenticated RCE via --enable-custom-logit-processor

Details

SGLang's multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will be deserialized without validation.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / sglang

Introduced in: 0.4.1.post7

No fixed version published yet for sglang (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-7304 [ADVISORY]
https://antiproof.ai/blog/three-rces-in-sglang [WEB]
https://github.com/sgl-project/sglang [PACKAGE]
https://github.com/sgl-project/sglang/tree/main/python/sglang [WEB]
https://pypi.org/project/sglang [PACKAGE]
https://github.com/advisories/GHSA-36m8-w8qf-g76p [ADVISORY]