SGLang’s multimodal generation runtime contains a flaw that permits the execution of arbitrary code when the optional flag --enable-custom-logit-processor is activated. Under this configuration the runtime passes untrusted data to dill.loads(), which deserializes Python objects without performing any validation. An attacker who can supply a maliciously crafted pickle payload can cause the runtime to import and execute arbitrary code, effectively compromising the host system. The weakness is a classic example of unsafe deserialization that can fully compromise confidentiality, integrity, and availability of the affected system.

Any deployment of the SGLang multimodal generation runtime that employs the --enable-custom-logit-processor option is vulnerable. No specific version constraints are listed, so every release before a future fix that validates dill deserialization is at risk. The vulnerability impacts users who run the runtime locally or on a network‑accessible machine where the option can be enabled.

The CVSS score is 9.8, indicating a high risk due to the ability to execute untrusted code without authentication. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote to the runtime process: an attacker who can invoke SGLang with the vulnerable flag can drop a malicious pickle payload, which the runtime will deserialize and execute. The exploitation requires the ability to configure or control the command line arguments for the runtime, implying the need for administrative or elevated privileges on the host.