The vulnerability is located in the _evaluate_filter() routine of SGLang, where a crafted filter expression can escape the eval() sandbox via the re.search __globals__ attribute. This allows an unauthenticated user to inject and run arbitrary Python code on the scheduler process during a forward pass. The primary impact is remote code execution with potential full control over the host system. The flaw is a classic code injection weakness (CWE-95).

SGLang versions 0.5.10 through 0.5.22 from the sgl-project are affected. Any installation of these releases that exposes the /dumper/configure HTTP endpoint is susceptible. The vulnerability can affect systems that have the DUMPER_SERVER_PORT enabled, as the endpoint is reachable without authentication.

The CVSS score of 9.2 marks this as critical. EPSS data is not available, so the precise exploitation probability is unknown, but the lack of authentication and the high severity imply a significant risk. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote network request to the /dumper/configure endpoint, where a crafted filter expression can be delivered and executed on the server.