SGLang’s multimodal generation runtime scheduler exposes a ROUTER socket that, by default, listens on 0.0.0.0 and directly deserializes incoming messages with pickle.loads. Because the socket is open to the network, an attacker can send a crafted pickle payload and trigger arbitrary code execution on the host. This flaw aligns with insecure deserialization weaknesses (CWE‑502).

The vulnerability affects the SGLang product family; no specific version information was provided in the advisory, so all releases that include the described scheduler configuration may be impacted.

The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog. However, the design of the flaw provides a direct network attack surface: any party with outbound connectivity to the exposed socket can inject malicious pickle data and run code at the process level. Consequently, the risk is high and exploitation is likely if the socket remains publicly reachable.