Stuub/SGLang-0.5.9-RCE

GitHubRepository PoCExploitPython

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python exploit for CVE-2026-5760 that generates a malicious GGUF model file and demonstrates remote code execution via unsandboxed Jinja2 template rendering in SGLang's reranking endpoint.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2026-5760. The script generates a malicious GGUF model file and demonstrates the unsandboxed Jinja2 rendering vulnerability in SGLang. All behavior is consistent with a standard proof-of-concept exploit for the stated vulnerability; no concealed backdoor, deceptive payload, or operator-directed harm (such as credential theft, persistence, or unrelated remote access) is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareSGLang
Attack typesServer-Side Template Injection (SSTI)Remote Code Execution (RCE)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains functional code that generates a malicious model file and directly executes a payload via the vulnerable code path, which is the definition of an exploit.

exploit.py:1-57README.md:1

Requirements

  • Victim must load the generated malicious GGUF model file into SGLang.README.md:15
  • The /v1/rerank endpoint must be accessible and called after the model is loaded.README.md:16

Observed behavior

  • Generates a GGUF model file containing a malicious Jinja2 chat template payload.exploit.py:12-26
  • Directly calls the vulnerable unsandboxed Jinja2 rendering function to execute an arbitrary OS command.exploit.py:28-47
  • The payload uses lipsum.__globals__["os"].popen() to escape the template sandbox and run shell commands.exploit.py:10
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload
{{ lipsum.__globals__["os"].popen(cmd).read() }}The payload executes an attacker-supplied shell command via Jinja2 SSTI, which is the documented exploit mechanism for CVE-2026-5760.exploit.py:10
Vulnerable Code Path
jinja2.Environment() used instead of ImmutableSandboxedEnvironmentThe exploit script directly replicates the vulnerable SGLang code path to demonstrate RCE, matching the CVE description.exploit.py:37-41
Review boundaries

What the analysis did not establish

  • The exploit.py script simulates the vulnerable rendering locally rather than sending a request to a live SGLang server, but it directly exercises the vulnerable code path.
  • Only the two text files (README.md and exploit.py) were reviewed; no binary files were present in the evidence packet.
  • The review does not assess whether the generated GGUF file would function as described, only that the supplied source code contains no backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1