CVE-2026-5760

CRITICAL

SGLang - Remote Code Execution via Malicious Tokenizer Chat Template

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-5760. PoCs published by Stuub.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-5760, demonstrating an SSTI-to-RCE vulnerability in SGLang's reranking endpoint due to unsandboxed Jinja2 template rendering. The exploit generates a malicious GGUF model file and triggers arbitrary code execution via the `/v1/rerank` endpoint.

Description

SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().

Exploits (1)

nomisec WORKING POC 6 stars

by Stuub · poc

https://github.com/Stuub/SGLang-0.5.9-RCE

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2026-5760, demonstrating an SSTI-to-RCE vulnerability in SGLang's reranking endpoint due to unsandboxed Jinja2 template rendering. The exploit generates a malicious GGUF model file and triggers arbitrary code execution via the `/v1/rerank` endpoint.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: SGLang 0.5.9

No auth needed

Prerequisites: Attacker must craft a malicious GGUF model file with a Jinja2 SSTI payload · Victim must load the model into SGLang and call the `/v1/rerank` endpoint

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed May 03, 2026 Full analysis →