An unauthenticated remote code execution vulnerability in SGLang poses a critical risk to system integrity and confidentiality, as it allows attackers to execute arbitrary commands via malicious payloads.

This vulnerability is caused by an incomplete denylist in the SafeUnpickler mechanism, which allows unauthenticated remote attackers to bypass security controls by sending crafted base64-encoded pickle payloads to the load_lora_adapter_from_tensors function.

Successful exploitation of this flaw grants an attacker full control over the affected system, leading to complete compromise of sensitive data, potential lateral movement within the network, and significant operational disruption. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it requires no user interaction or authentication to trigger, making it an ideal target for automated exploitation.

Immediate Action: Restrict network access to the SGLang API to trusted sources only and update the software to the latest version as soon as a patch is released by the vendor.

Proactive Monitoring: Inspect server access logs for suspicious requests directed at the load_lora_adapter_from_tensors endpoint, particularly those containing base64-encoded strings or unusual payload patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or inspect incoming requests containing serialized Python objects or suspicious pickle-related patterns to prevent unauthorized payload delivery.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with its unauthenticated nature, necessitates immediate attention from security teams. Organizations should isolate affected SGLang instances from public-facing networks until a vendor-provided patch is applied to neutralize the deserialization risk.