| Package | Affected versions | Patched versions |
|---|---|---|
| sglang | ≤ 0.5.15 |
SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free