The vulnerabilities
Two critical severity vulnerabilities were disclosed in SGLang, a high-throughput LLM inference framework used in production AI deployments. Both are rated CVSS 9.8 and allow unauthenticated remote code execution. The first exploits Jinja2 template injection in SGLang's prompt templating layer. The second targets unsafe pickle deserialization in the model serving path. A remote attacker with network access to an SGLang inference endpoint can achieve code execution on the host running the inference server without credentials.
Why this matters beyond the CVE
SGLang inference servers often run on GPU-equipped hosts with network access to model weights, training data, or internal APIs. Code execution on an inference server is not just a server compromise: it can mean access to proprietary model weights, training datasets, or the broader infrastructure that model serving is integrated with. As AI inference moves into production environments, the attack surface of inference frameworks becomes a first-class concern for enterprise security teams.
How the exploits work
The Jinja2 injection path exploits untrusted input being passed into a template rendering context without sanitization. Crafted prompt inputs that include Jinja2 expression syntax execute arbitrary code in the server's Python environment. The pickle deserialization path exploits SGLang's handling of serialized objects during model loading or inter-process communication. Untrusted pickle data is deserialized without validation, allowing an attacker to embed arbitrary code in the serialized payload.
What to do
- Update SGLang to the patched version that addresses both vulnerabilities. Check SGLang release notes for the specific version containing the fix.
- Restrict network access to SGLang inference endpoints to trusted internal networks. Inference servers should not be internet-accessible.
- Audit any application code that passes user input into prompt templates or deserializes external objects before reaching the inference layer.
The durable lesson
AI inference frameworks carry the same categories of vulnerability as traditional web application frameworks. Template injection, deserialization issues, and authentication bypasses are not new vulnerability classes. What is new is that these vulnerabilities now appear in infrastructure that organizations may treat as internal tooling rather than as an attack surface requiring the same scrutiny as production web applications.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss AI infrastructure security or vulnerability management for your organization.