CVE-2026-3989

HIGH

SGLangs replay_request_dump.py - Deserialization

Title source: llm
STIX 2.1

Description

SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.

Scores

CVSS v3 7.8
EPSS 0.0002
EPSS Percentile 3.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

Status published
Products (3)
pypi/sglang 0 - 0.5.10PyPI
SGLang/SGLang 0.5.10
SGLang/SGLang 0.5.5 - 0.5.9
Published Mar 12, 2026
Tracked Since Mar 12, 2026