CVE-2026-15971

Analyzed Analyzed - Analysis Complete

RCE via Sandbox Escape in SGLang with DUMPER_SERVER_PORT

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: CERT/CC

Description

SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-20

AI Q&A

2026-07-31

EPSS Evaluated

2026-08-19

NVD

CVE-2026-15971

EUVD

EUVD-2026-51262

Affected Vendors & Products

Vendor	Product	Version / Range
lmsys	sglang	to 0.5.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

SGLang has a remote code execution vulnerability in its dumper subsystem. If the optional dumper is enabled and the DUMPER_SERVER_PORT is configured, an attacker can bypass sandbox restrictions and execute arbitrary code during inference requests.

Detection Guidance

Detection requires checking if SGLang is running with the dumper subsystem enabled and DUMPER_SERVER_PORT set. Inspect SGLang configuration files and environment variables for these settings. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows attackers to run malicious code on systems running SGLang with the dumper subsystem enabled. This could lead to unauthorized access, data theft, or system compromise if exploited.

Compliance Impact

The vulnerability enables remote code execution (RCE) and sandbox escape, which could lead to unauthorized access to sensitive data. This may violate GDPR's data protection requirements and HIPAA's security rules for protected health information if exploited.

Mitigation Strategies

Disable the dumper subsystem if enabled and ensure DUMPER_SERVER_PORT is not set. Review inference requests for suspicious code execution patterns.

Hi! I’m here to help you understand CVE-2026-15971. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70