SGLang's /v1/rerank API loads a model file that may contain a malicious tokenizer.chat_template. During rendering, the library invokes Jinja2 without sandboxing, allowing the template code to execute as part of the service. This flaw permits an attacker who can supply a crafted model file to execute arbitrary code on the host running SGLang, leading to full system compromise. The weakness originates from unsanitized template execution and is related to CWE-94.

The vulnerability affects the SGLang application, specifically the reranking endpoint /v1/rerank. No specific version numbers are provided, but the issue exists in the current release used at the time of the report. The product is identified as SGLang:SGLang by the CNA. Administrators should check any instance of SGLang exposing the rerank API for potential exploitation.

The CVSS score is 9.8, and the EPSS score is unavailable, but the presence of RCE implies a high severity risk. The attack requires delivery of a malicious tokenizer.chat_template via a model file that the SGLang service processes. While the exact privilege level needed to upload the model is not detailed, it is inferred that an adversary with sufficient write access to the model storage can trigger the flaw. The vulnerability is not listed in the CISA KEV catalog, but its exploitability, combined with the lack of sandboxing, suggests that it could be leveraged by attackers with network access to the affected service.