# SGLang RCE via malicious GGUF model upload

Published: 2026-04-20 · Severity: elevated · Sectors: technology
Canonical: https://vorant.io/reports/b5b5c53d-14ee-51bb-92a1-44f910d65e53/sglang-rce-via-malicious-gguf-model-upload

> Remote code execution in SGLang reranking endpoint when loading crafted GGUF model files with malicious Jinja2 templates.

SGLang, an open-source framework for serving large language models and multimodal AI, contains a critical remote code execution vulnerability in the /v1/rerank endpoint. The vulnerability stems from unsafe Jinja2 template rendering in the getjinjaenv() function, which lacks sandboxing. An attacker can craft a malicious GGUF model file with a weaponized tokenizer.chat_template parameter containing a Jinja2 server-side template injection (SSTI) payload. When a victim downloads and loads this model in SGLang, the malicious template executes arbitrary Python code on the server when the reranking endpoint is accessed.

Successful exploitation grants arbitrary code execution in the SGLang service context, enabling host compromise, lateral movement, data exfiltration, or denial-of-service attacks. The attack requires the victim to explicitly load a malicious model file, but the ease of model sharing in AI/ML environments makes this a practical attack vector. Deployments exposing the reranking interface to untrusted networks face the highest risk.

The CERT/CC notes that no response or patch was obtained from SGLang maintainers during the coordination process. Remediation requires replacing jinja2.Environment() with ImmutableSandboxedEnvironment to prevent arbitrary code execution during template rendering.

## Mentioned in this report

- Vulnerabilities: CVE-2026-5760

## Detection guidance (public sample)

### SGLang Server Process Spawning Shell Interpreter

ATT&CK: T1059.006

Python process running an SGLang server spawns a shell, consistent with Jinja2 SSTI code execution via a malicious GGUF chat_template on /v1/rerank. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SGLang Server Process Spawning Shell Interpreter
description: Detects a Python process hosting SGLang (for example launch_server) spawning
  a shell interpreter. Exploitation of the unsandboxed Jinja2 rendering in the /v1/rerank
  endpoint (malicious GGUF tokenizer.chat_template) yields arbitrary Python execution
  that commonly pivots to a shell. Generalises on the parent/child relation, not payload
  strings.
references:
- https://kb.cert.org/vuls/id/915947
tags:
- attack.execution
- attack.t1059.006
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: /python
    ParentCommandLine|contains: sglang
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
    - /ash
  filter_ldconfig:
    CommandLine|contains: ldconfig
  condition: selection and not filter_ldconfig
falsepositives:
- Administrators or deployment scripts running shell helpers from within a custom
  SGLang Python wrapper
- Library lookup helpers invoked through a shell during SGLang startup
level: high
id: c46d52da-0eb8-5bbe-b80c-ee1e64a77ded
status: experimental
author: Vorant
```

### SGLang Server Process Spawning Download or Recon Utilities

ATT&CK: T1190

SGLang Python server spawning network download, reverse-shell or host reconnaissance utilities, indicating post-exploitation after SSTI through a malicious model template. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SGLang Server Process Spawning Download or Recon Utilities
description: Detects a Python process hosting SGLang directly spawning download tools,
  netcat/socat style utilities, or host discovery commands. This is typical follow-on
  activity after template-injection RCE in the reranking endpoint. Generalises on
  the parent/child relation rather than a specific payload.
references:
- https://kb.cert.org/vuls/id/915947
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: /python
    ParentCommandLine|contains: sglang
    Image|endswith:
    - /curl
    - /wget
    - /nc
    - /ncat
    - /netcat
    - /socat
    - /whoami
    - /id
    - /uname
    - /hostname
    - /ifconfig
    - /base64
  condition: selection
falsepositives:
- Custom SGLang health-check or model-download wrappers that call curl or wget directly
  from the server process
- Monitoring plugins that call hostname or uname from the serving process
level: high
id: d940f1a0-efb3-5601-bb84-72ad5d42b41f
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/915947

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b5b5c53d-14ee-51bb-92a1-44f910d65e53/sglang-rce-via-malicious-gguf-model-upload.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup