CVE-2026-111391
Deferred Deferred - Pending Action

Code Injection in SGLang via Filter Expression

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111391
EUVD
EUVD-2026-102845

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sgl-project sglang 0.5.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111391 is a code injection vulnerability in SGLang versions 0.5.10 through 0.5.22. It allows remote attackers to execute arbitrary Python code by exploiting a flaw in the _evaluate_filter() function. The vulnerability bypasses the eval() sandbox through the __globals__ escape mechanism using re.search or re.match functions. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, executing code in the scheduler process on the next forward pass.

Detection Guidance

Check if SGLang versions 0.5.10 through 0.5.22 are installed by running: sglang --version. Inspect network traffic for requests to /dumper/configure endpoints with DUMPER_SERVER_PORT set. Monitor scheduler processes for unexpected Python code execution or system command invocations.

Impact Analysis

This vulnerability allows attackers to execute arbitrary Python code in the scheduler process. This could lead to full system compromise, including reading or modifying sensitive data, executing system commands, crashing the service, or gaining unauthorized access to model parameters and internal states. The impact includes high risks to confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's privacy and security rules. It may result in data breaches, unauthorized disclosure of personal or health information, and failure to maintain data integrity and confidentiality, potentially leading to regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade SGLang to a patched version replacing eval() with an AST-based evaluator. Disable the dumper feature if not needed. Restrict access to /dumper/configure and /generate endpoints. Ensure admin API keys are configured and rotate existing keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111391. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart