CVE-2026-5760
CVE-2026-5760
Description
SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().
INFO
Published Date :
April 20, 2026, 2:16 p.m.
Last Modified :
April 29, 2026, 2:16 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Update SGLang to the latest version.
- Ensure model files are from trusted sources.
- Review Jinja2 template rendering security.
Public PoC/Exploit Available at Github
CVE-2026-5760 has a 7 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-5760.
| URL | Resource |
|---|---|
| https://github.com/Stuub/SGLang-0.5.9-RCE | |
| https://github.com/sgl-project/sglang/pull/23660 | |
| https://www.kb.cert.org/vuls/id/915947 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-5760 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-5760
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
HTML TypeScript Python PowerShell Shell JavaScript
None
None
Python Dockerfile
Proof of Concept exploitation of CVE-2026-5760 - RCE in SGLang 0.5.9 via malicious GGUF
cve sglang cve-2026-5760
Python
Threat Hunting based on KQL
None
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-5760 vulnerability anywhere in the article.
-
Daily CyberSecurity
Critical 9.8 RCE Threat to SGLang AI Infrastructure
A critical remote code execution (RCE) vulnerability has been uncovered in SGLang, a popular open-source framework used to serve advanced models like DeepSeek and Mistral. The flaw, officially tracked ... Read more
-
CybersecurityNews
Hackers Could Weaponize GGUF Models to Achieve RCE on SGLang Inference Servers
A critical vulnerability in the SGLang inference server that allows threat actors to execute arbitrary code. Tracked as CVE-2026-5760, this flaw allows hackers to weaponize standard GGUF machine learn ... Read more
The following table lists the changes that have been made to the
CVE-2026-5760 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Apr. 29, 2026
Action Type Old Value New Value Added Reference https://github.com/sgl-project/sglang/pull/23660 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 20, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-94 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Apr. 20, 2026
Action Type Old Value New Value Added Reference https://www.kb.cert.org/vuls/id/915947 -
New CVE Received by [email protected]
Apr. 20, 2026
Action Type Old Value New Value Added Description SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment(). Added Reference https://github.com/Stuub/SGLang-0.5.9-RCE