SGLangGHSA-9w53-xr52-mwgj
SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor
Medium7.3CVE-2025-10164 · Published Sep 9, 2025 · updated Jul 7, 2026
A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The manipulation of the argument serialized_named_tensors results in deserialization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| sglang PyPI | < 0.5.4 | 0.5.4 |
Details and references
More SGLang advisories
All SGLang| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 18 | SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability Critical9.1May 18 | Critical9.1 | No fix yet |
| May 18 | SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socketCritical9.8May 18 | Critical9.8 | No fix yet |
| May 3 | SGLang has an Improper Input Validation/Injection IssueMedium5.6May 3 | Medium5.6 | No fix yet |
| Mar 12 | SGLang: remote code executionCritical9.8Mar 12 | Critical9.8 | 0.5.10 |
| Mar 12 | SGLang: remote code executionCritical9.8Mar 12 | Critical9.8 | 0.5.10 |
| Mar 12 | SGLang: unsafe deserializationHigh7.8Mar 12 | High7.8 | 0.5.10 |