Three Critical SGLang Flaws Expose AI Servers to Remote Code Execution

SGLang is an open-source inference framework used to deploy and serve large language models, making flaws in its network-facing components potentially consequential for AI infrastructure and the data it handles. The newly disclosed vulnerability stems from unsafe deserialization of Python Pickle files, a format capable of invoking code during loading. Exploitation could give an attacker control of the underlying server rather than merely disrupting a model response.

The U.S. CERT Coordination Center, or CERT/CC, disclosed the issue as CVE-2026-14890 and assigned it a CVSS severity score of 9.1. An unauthenticated attacker can send a malicious Pickle file to a vulnerable SGLang service and execute arbitrary code remotely. As of July 21, 2026, the project team had not released a patch. CERT/CC advised users to restrict access to exposed service interfaces and disable affected or high-risk processes as interim safeguards.

SGLang is an open-source large language model inference framework that helps companies and research institutions deploy AI services. CVE-2026-5760, disclosed in 2026, is a remote code execution vulnerability. The risk extends beyond model output and could directly expose servers hosting inference services and sensitive data to attackers.

The latest investigation found that attackers can embed malicious payloads in Jinja2 templates within GGUF models. Once an administrator loads the model, a request to a specific endpoint may trigger arbitrary code execution. As of July 20, 2026, affected deployments should restrict untrusted models, reduce endpoint exposure, and apply updates or isolation measures in line with SGLang project advisories.