Insecure Deserialization Flaw in SGLangs Python Script

CVE-2026-3989

What is CVE-2026-3989?

The SGLangs replay_request_dump.py script contains an insecure use of the pickle.load() method, allowing for the potential execution of arbitrary code. This vulnerability arises when the script does not validate or properly secure the deserialization process. An attacker could craft a malicious .pkl file, which if processed by the vulnerable script, could lead to the execution of unauthorized code on the host machine. Users of this script should be aware of the risks and implement necessary mitigations to safeguard against exploitation.

References