Remote Code Execution Vulnerability in SGLang Product by an Open Source Vendor

CVE-2026-15976

What is CVE-2026-15976?

The SGLang product contains a critical vulnerability that allows remote code execution when loading model weights from a HuggingFace repository. This occurs specifically in the /update_weights_from_disk function, where the fallback mechanism uses 'torch.load(..., weights_only=False)' for deserialization of .bin files. This flaw can potentially allow an attacker to execute arbitrary code on the host system by manipulating the data loaded from the external source.

References