SGLang’s multimodal generation runtime contains a flaw that allows an unauthenticated attacker to execute arbitrary code on the host. The flaw originates from the disaggregated‑diffusion orchestrator where a ZeroMQ ROUTER socket is bound to a network interface without authentication. The server blindly reads the final frame of multipart ZeroMQ messages and passes it to Python’s pickle.loads() without any validation. Because pickle can instantiate arbitrary objects, this leads directly to remote code execution when an attacker sends a crafted serialized payload.

The vulnerability affects the SGLang product from the SGLang company. No specific version information is currently disclosed, so all releases are potentially impacted until a patch is released.

The CVSS score is 9.8. Even though the vulnerability is not yet listed in CISA’s KEV catalog, the attack surface is high: any user who can connect to the exposed ZeroMQ port can supply a malicious payload and gain code execution privileges on the server. Since the socket accepts connections without authentication, the risk is remote and can be exploited from any network segment that can reach the service. No additional exploitation prerequisites are noted beyond network connectivity.