A newly disclosed vulnerability in the SGLang inference server, CVE-2026-5760, exposes a critical architectural flaw in how some AI serving frameworks handle untrusted model artifacts. With a CVSS score of 9.8, the issue allows remote code execution via a poisoned GGUF model file, directly compromising the server.

The attack exploits the `/v1/rerank` endpoint. An attacker crafts a GGUF file with a malicious `tokenizer.chat_template` parameter containing a Jinja2 server-side template injection payload. When SGLang loads this model and a request triggers the reranking endpoint, the system renders the template using an unsafe `jinja2.Environment()` call. This design choice, instead of employing a restricted `ImmutableSandboxedEnvironment`, permits the embedded payload to execute arbitrary Python code on the host.

This vulnerability class is not new; it mirrors past issues in llama_cpp_python (CVE-2024-34359) and vLLM. It underscores a persistent engineering trade-off: the convenience of flexible templating versus the security imperative of sandboxing when processing user-supplied or externally sourced model files. The official mitigation is to switch to the sandboxed Jinja2 environment, a change that restricts functionality to prevent code execution. As of the disclosure, no patch was available from the project maintainers, leaving operators to implement this fix themselves. For teams serving models from public repositories, this vulnerability necessitates immediate review of model provenance and template rendering configurations.

Source: The Hackers News