Unauthenticated RCE in SGLang via Pickle Payload

Executive Summary

SGLang has an unauthenticated remote code execution vulnerability in the /load_lora_adapter_from_tensors endpoint. It allows attackers to bypass SafeUnpickler's incomplete denylist and execute arbitrary commands using crafted base64-encoded pickle payloads.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual network traffic or processes related to SGLang and pickle payloads. Check for unexpected base64-encoded data in logs or network requests targeting /load_lora_adapter_from_tensors. Inspect running processes for unauthorized command execution or unusual child processes spawned by SGLang.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to remotely execute arbitrary code on your system without authentication. This could lead to full system compromise, data theft, or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. Organizations may face legal penalties, data breach notifications, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to /load_lora_adapter_from_tensors by implementing authentication and input validation. Disable unpickling of untrusted data or replace SafeUnpickler with a stricter deserialization method. Update SGLang to the latest patched version if available. Monitor for signs of exploitation and isolate affected systems.

Useful 0 Not Useful 0