A critical code injection vulnerability in SGLang allows unauthenticated remote attackers to achieve Remote Code Execution by supplying malicious Jinja2 chat templates.

This is a code injection vulnerability (CWE-94) located in the /v1/rerank endpoint. The application improperly processes model files containing malicious Jinja2 templates using an unsandboxed environment, allowing arbitrary code execution upon rendering.

With a CVSS score of 9.8, this vulnerability represents a critical risk, allowing for full system compromise. An attacker could execute arbitrary commands on the host server, leading to data exfiltration, service disruption, or further lateral movement within the network infrastructure.

Immediate Action: Update the SGLang installation to the version containing the fix (commit 612785ffdcaf35552f1ed433a981d596ca9fe900).

Proactive Monitoring: Monitor server process execution logs for unexpected child processes originating from the SGLang service.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing Jinja2 template syntax in the reranking endpoint payloads.

Public Exploit Available: Yes — a public proof-of-concept repository is available at https://github.com/Stuub/SGLang-0.5.9-RCE.

Given the critical nature of this RCE vulnerability and the availability of a public proof-of-concept, immediate patching is required. Organizations using SGLang must ensure they are using a version where the Jinja2 environment is properly sandboxed.