Home / Vulnerability Intelligence / CVE-2026-7669

CVE-2026-7669 - Vulnerability Analysis

MediumCVSS: 5.6

Last Updated: May 4, 2026

sgl-project SGLang - Insecure Deserialization

Published: May 2, 2026Updated: May 4, 2026PoC AvailableRemote Exploitable

Overview

sgl-project SGLang <= 0.5.9 contains an insecure deserialization caused by manipulation in get_tokenizer function of HuggingFace Transformer Handler, letting remote attackers execute code, exploit requires complex conditions.

Severity & Score

Severity: Medium

CVSS Score: 5.6

Impact

Remote attackers can execute arbitrary code via deserialization, potentially leading to full system compromise.

Mitigation

Update to the latest version.

References

https://vuldb.com/vuln/360817
https://vuldb.com/vuln/360817/cti
https://github.com/gouldnicholas/CVE-2026-7669-PoC
https://vuldb.com/submit/799263

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-7669
Severity: Medium
CVSS Score: 5.6
Type: insecure_deserialization
Status: new

CWE

CWE-74

CVSS Metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L