SGLang through 0.5.21 allows an attacker to supply arbitrary mm_hashes values that are used as the multimodal prefix‑cache key. This results in key collision and cache poisoning so that a second request can retrieve, view, or alter the image associated with an earlier request. The vulnerability enables a remote adversary to read secret image data or corrupt model responses for other users, potentially leaking sensitive visual content. There is no direct code execution or privilege escalation. The core weakness is a data‑basing flaw that causes unintended data exposure via the cache.

sgl-project SGLang versions up to and including 0.5.21 are affected. The vulnerability is tied to the /generate endpoint of the SGLang library used in multimodal workflows.

The CVSS score of 6.3 indicates a medium severity exploitation path. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack likely requires remote access to the /generate HTTP endpoint and knowledge of the prefix‑cache key scheme to poison the cache. Once poisoned, the attacker can read or tamper with another user’s cache entries across subsequent requests.