Arbitrary Code Execution in SGLang via Unsafe Pickle Deserialization

Executive Summary

CVE-2026-93034 is an arbitrary code execution flaw in SGLang v0.5.18 caused by unsafe deserialization of PickleWrapper payloads via pickle.loads() in the ZMQ message decoder. Even when SGLANG_USE_PICKLE_IPC is disabled, the vulnerability persists through the msgpack path. It becomes remotely exploitable if data-parallel attention is enabled with a non-loopback network binding.

Useful 0 Not Useful 0

Detection Guidance

Check if SGLang is running with data-parallel attention enabled and bound to a non-loopback TCP address. Inspect logs for ZeroMQ message decoding errors or unexpected PickleWrapper usage. Monitor for arbitrary file creation or process ID markers in service directories.

Useful 0 Not Useful 0

Impact Analysis

An attacker could send malicious messages to an exposed internal receiver, executing arbitrary code on the affected system. This requires specific non-default settings like data-parallel attention and a non-loopback TCP address. Successful exploitation grants control over the service or underlying machine.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data processed by SGLang. For GDPR, it may violate principles of data protection by enabling unauthorized access to personal data. For HIPAA, it could compromise protected health information if exploited in healthcare systems.

Useful 0 Not Useful 0

Mitigation Strategies

Disable data-parallel attention and ensure internal receivers only bind to loopback addresses. Update SGLang to a patched version if available. Block external access to internal ZeroMQ ports and review message serialization configurations.

Useful 0 Not Useful 0