The vulnerability resides in SGLang’s /load_lora_adapter_from_tensors endpoint, where an insecure use of Python’s pickle deserialization permits bypassing of SafeUnpickler’s denylist. This flaw allows an attacker to craft a base64‑encoded pickle payload that, when processed, can execute arbitrary system commands. The resulting impact is full remote code execution, giving an attacker control over the target system with whatever privileges the process runs under. This weakness is classified as unsafe deserialization of untrusted data. The description indicates that no authentication is required to trigger the flaw, making it an unauthenticated RCE.

The affected product is SGLang. Specific vendors and product names are limited to SGLang; the precise affected versions are not enumerated in the advisory, so any deployed instance that includes the /load_lora_adapter_from_tensors functionality should be considered potentially vulnerable until a patch is applied.

With a CVSS score of 9.8, the vulnerability is considered critical. The EPSS score of less than 1 % indicates a low but non‑zero likelihood of exploitation. The vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is a plain HTTP or HTTPS request to the vulnerable endpoint, requiring no authentication or special permissions. An attacker can deliver the malicious payload from any external network that can reach the service, making the risk considerably high for exposed deployments.