SGLang contains an insecure deserialization bug that allows remote code execution when loading model weights from a HuggingFace repository. The flaw stems from the /update_weights_from_disk routine that calls torch.load(..., weights_only=False), which falls back to pickle deserialization of .bin files. An attacker who can supply a malicious .bin file will cause arbitrary code to run within the process. This is a classic deserialization vulnerability, CWE-502, that can compromise confidentiality, integrity, and availability of the host.

Every installation of the SGLang library that utilizes the update_weights_from_disk functionality is potentially affected. The advisory does not list specific version numbers, so any version of the library that implements this feature without mitigating the pickle fallback is at risk.

The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of exploitation in the wild. However, the conditions required for exploitation are easy to meet in environments that ingest third‑party models, because a malicious .bin file can be introduced by placing a crafted file in a trusted HuggingFace repository or by tampering with a local model directory. The CVSS score of 9.8 indicates a critical impact; if successfully exploited, the attacker can attain full control of the running process.