A vulnerability in the get_tokenizer function of sgl-project SGLang’s HuggingFace Transformer handler allows an attacker who passes trust_remote_code=False to override the caller’s explicit security setting. The library then silently calls AutoTokenizer.from_pretrained again with trust_remote_code=True. If the tokenizer configuration contains a malicious tokenizer.py via auto_map in tokenizer_config.json, arbitrary Python code is executed in the SGLang process. The attack can be launched remotely, requires high complexity, and is considered difficult, but success results in full code execution with no log lines or warnings generated.

sgl-project SGLang versions up to 0.5.9 are affected by this flaw. No patched versions are listed in the CVE data.

The CVSS score of 6.3 indicates a moderately high severity, while the EPSS score of <1% suggests exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. The exploit is remote, requires the attacker to call get_tokenizer with a crafted trust_remote_code payload, and benefits from the second unconditional call that overrides user input. Successful exploitation would give the attacker arbitrary code execution in the SGLang process.