SGLang versions through 0.5.15 are vulnerable to unauthenticated remote code execution, posing a critical risk of full system compromise.

This vulnerability stems from CWE-502, where the application performs insecure deserialization of untrusted data during the model weight loading process. An unauthenticated attacker can trigger this flaw via the /update_weights_from_disk endpoint by providing malicious .bin files that exploit the pickle deserialization fallback.

The ability to achieve remote code execution allows an attacker to gain full control over the underlying host system. Given the CVSS score of 9.8, this represents a critical risk that could lead to unauthorized data access, lateral movement within the network, and complete service disruption.

Immediate Action: Organizations should restrict access to the /update_weights_from_disk endpoint and monitor for vendor releases providing a patch for this deserialization flaw.

Proactive Monitoring: Review web server and application access logs for unusual requests directed at the /update_weights_from_disk endpoint, particularly those involving large or unexpected file uploads.

Compensating Controls: Implement strict network ingress filtering to ensure that only trusted IP addresses can communicate with the SGLang service, and utilize a Web Application Firewall to block suspicious payload patterns.

Public Exploit Available: Unknown

This vulnerability is severe due to the ease of remote exploitation and the potential for total system compromise. Administrators must prioritize isolating the affected service from external networks until a security update is applied to remediate the insecure deserialization process.