SGLang exposes an endpoint that deserializes arbitrary pickle payloads without requiring authentication. The SafeUnpickler policy, designed to restrict dangerous objects, can be bypassed because builtins.import and builtins.getattr are callable, allowing an attacker to craft a payload that triggers the REDUCE function. This results in arbitrary code execution on the server.

The vulnerability affects the SGLang application itself, particularly deployments where no authentication keys are configured for the /update_weights_from_tensor service. No specific product versions are listed, so any instance running the vulnerable code path is at risk.

The flaw is reachable via an unauthenticated network request to the /update_weights_from_tensor endpoint. An attacker only needs connectivity to the host. Successful exploitation would give the attacker the same privileges as the SGLang process, potentially enabling full control over the server. No CVSS score is provided, but the lack of authentication and the ability to execute payloads denotes a high severity. EPSS is not available, and the issue has not been listed in the CISA KEV catalog, but the risk remains significant.