Imagine downloading what looks like a legitimate AI model — and in the moment it loads, a stranger on the internet gains complete, silent control of the machine running it.
Who Is at Risk, and How Bad Is This?
SGLang is one of the most widely used inference frameworks in the fast-growing world of large language model (LLM) deployment. Researchers, startups, and enterprise AI teams use it to serve AI models at scale — from document summarization tools to search and ranking systems. If you've stood up an AI service in the last year, there's a reasonable chance SGLang is somewhere in your stack.
The vulnerability — tracked as CVE-2026-5760 and rated 9.8 out of 10 (CRITICAL) on the industry-standard severity scale — affects any person or organization that uses SGLang's reranking feature and loads model files from external or untrusted sources. That includes academic labs pulling models from public repositories like Hugging Face, companies fine-tuning open-source models, and any developer experimenting with AI ranking pipelines. The blast radius is broad, cross-platform, and the bar for exploitation is disturbingly low.
What an Attacker Can Actually Do
Here's the scenario in plain terms: AI models aren't just mathematical weights stored in a file. They come packaged with configuration files — small instruction sheets that tell the software how to process text before feeding it to the model. One of those instruction sheets is called a chat template, and it's written in a simple scripting language.
The problem is that SGLang reads those chat templates and executes them with absolutely no guardrails in place. An attacker who wants to exploit this doesn't need to break any encryption, guess any passwords, or find a way through a firewall. They simply need to upload a model to a public repository — or convince a target to use one they've prepared — with a booby-trapped chat template hidden inside. The moment someone loads that model into SGLang and the reranking endpoint wakes up, the malicious instructions inside the template run automatically on the server, with full system privileges. The attacker can read files, steal credentials, install backdoors, pivot deeper into a corporate network, or wipe the system entirely. The victim may see nothing unusual at all.
This is essentially a supply chain attack delivered through AI model files — a threat vector that security teams are only beginning to take seriously, even as model sharing has exploded in popularity. The attack requires no interaction beyond the initial model load, making it particularly dangerous in automated machine learning pipelines where models are pulled and deployed without manual review.
The Technical Root Cause
For the security researchers in the room: the vulnerability is a server-side template injection (SSTI) via an unsandboxed jinja2.Environment() instance in SGLang's /v1/rerank endpoint. Jinja2, the Python templating engine, is powerful enough to execute arbitrary Python code when its sandbox is not explicitly enabled — and here, it isn't. The tokenizer.chat_template field inside a loaded model file is passed directly into this unsandboxed environment and rendered without any sanitization or restriction on built-in access. This gives an attacker a straight path to Python's os module and full shell execution. CVSS score: 9.8 (Critical), with low attack complexity, no privileges required, and no user interaction needed beyond model loading.
Has Anyone Been Hit Yet?
As of publication, no active exploitation has been confirmed in the wild. However, security researchers who analyzed the flaw note that the technique is straightforward enough that a moderately skilled attacker could weaponize it quickly. The attack surface is also quietly expanding: as more organizations automate AI model deployment pipelines — pulling the latest models nightly from public hubs — the window for an opportunistic supply chain attack grows without anyone necessarily noticing.
The vulnerability was disclosed publicly through SGLang's security advisory process. No specific threat actor or active campaign has been attributed at this time, but the combination of a near-perfect severity score and a trivially constructable exploit means the clock is running. Security teams in organizations running AI inference infrastructure should treat this as urgent — not merely important.
What You Need to Do Right Now
The following three steps apply whether you're a solo developer or running an enterprise AI platform:
-
Patch or upgrade SGLang immediately. Check the official SGLang GitHub repository for the patched release that addresses CVE-2026-5760. If you are running any version of SGLang that uses the
/v1/rerankendpoint, assume you are vulnerable until you have confirmed you are on a fixed version. Pin your dependency versions and do not let automated package managers silently install unpatched builds. -
Audit every model file your systems have loaded or will load. Inspect the
tokenizer_config.jsonfile inside any model directory for thechat_templatefield. Legitimate templates contain only formatting logic — loops, conditionals, and string formatting. If you see anything that looks like Python import statements, calls toos,subprocess,eval, or any unexpected code constructs, treat the model as compromised and do not load it. Establish a policy of only loading models from sources you explicitly trust, and consider scanning model artifacts as part of your CI/CD pipeline. - Isolate AI inference workloads behind strict network controls. If you cannot patch immediately, run SGLang instances in network-isolated containers or virtual machines with no access to production credentials, databases, or internal services. Apply the principle of least privilege: the process running SGLang should have read-only access to model files and no ability to make outbound network connections to sensitive internal endpoints. This won't stop the initial code execution, but it dramatically limits what an attacker can do with it.
CVE: CVE-2026-5760 | CVSS: 9.8 Critical | Category: Remote Code Execution / Server-Side Template Injection | Platforms affected: All platforms running SGLang with the /v1/rerank endpoint | Active exploitation: Not confirmed as of publication