SGLang RCE via malicious GGUF model upload
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Remote code execution in SGLang reranking endpoint when loading crafted GGUF model files with malicious Jinja2 templates.
SGLang, an open-source framework for serving large language models and multimodal AI, contains a critical remote code execution vulnerability in the /v1/rerank endpoint. The vulnerability stems from unsafe Jinja2 template rendering in the getjinjaenv() function, which lacks sandboxing. An attacker can craft a malicious GGUF model file with a weaponized tokenizer.chat_template parameter containing a Jinja2 server-side template injection (SSTI) payload. When a victim downloads and loads this model in SGLang, the malicious template executes arbitrary Python code on the server when the reranking endpoint is accessed.
Successful exploitation grants arbitrary code execution in the SGLang service context, enabling host compromise, lateral movement, data exfiltration, or denial-of-service attacks. The attack requires the victim to explicitly load a malicious model file, but the ease of model sharing in AI/ML environments makes this a practical attack vector. Deployments exposing the reranking interface to untrusted networks face the highest risk.
The CERT/CC notes that no response or patch was obtained from SGLang maintainers during the coordination process. Remediation requires replacing jinja2.Environment() with ImmutableSandboxedEnvironment to prevent arbitrary code execution during template rendering.
Mentioned in this report
Detection guidance
SGLang Server Process Spawning Shell Interpreter
Python process running an SGLang server spawns a shell, consistent with Jinja2 SSTI code execution via a malicious GGUF chat_template on /v1/rerank. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SGLang Server Process Spawning Shell Interpreter
description: Detects a Python process hosting SGLang (for example launch_server) spawning
a shell interpreter. Exploitation of the unsandboxed Jinja2 rendering in the /v1/rerank
endpoint (malicious GGUF tokenizer.chat_template) yields arbitrary Python execution
that commonly pivots to a shell. Generalises on the parent/child relation, not payload
strings.
references:
- https://kb.cert.org/vuls/id/915947
tags:
- attack.execution
- attack.t1059.006
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains: /python
ParentCommandLine|contains: sglang
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /ash
filter_ldconfig:
CommandLine|contains: ldconfig
condition: selection and not filter_ldconfig
falsepositives:
- Administrators or deployment scripts running shell helpers from within a custom
SGLang Python wrapper
- Library lookup helpers invoked through a shell during SGLang startup
level: high
id: c46d52da-0eb8-5bbe-b80c-ee1e64a77ded
status: experimental
author: Vorant
SGLang Server Process Spawning Download or Recon Utilities
SGLang Python server spawning network download, reverse-shell or host reconnaissance utilities, indicating post-exploitation after SSTI through a malicious model template. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SGLang Server Process Spawning Download or Recon Utilities
description: Detects a Python process hosting SGLang directly spawning download tools,
netcat/socat style utilities, or host discovery commands. This is typical follow-on
activity after template-injection RCE in the reranking endpoint. Generalises on
the parent/child relation rather than a specific payload.
references:
- https://kb.cert.org/vuls/id/915947
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.006
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains: /python
ParentCommandLine|contains: sglang
Image|endswith:
- /curl
- /wget
- /nc
- /ncat
- /netcat
- /socat
- /whoami
- /id
- /uname
- /hostname
- /ifconfig
- /base64
condition: selection
falsepositives:
- Custom SGLang health-check or model-download wrappers that call curl or wget directly
from the server process
- Monitoring plugins that call hostname or uname from the serving process
level: high
id: d940f1a0-efb3-5601-bb84-72ad5d42b41f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/915947
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs