SGLang: Code injection via debug dumper filter in /dumper/configure

Summary

SGLang versions 0.5.10 through 0.5.22 contain a code injection flaw in the debug dumper filter evaluation (_evaluate_filter), which uses eval() with a bypassable sandbox. When the dumper server is enabled via DUMPER_SERVER_PORT, a remote attacker can send a crafted filter expression to the /dumper/configure endpoint and execute Python code in the scheduler process on the next forward pass. The CVE describes the endpoint as unauthenticated, but the research indicates that a valid API key may be sufficient, so this point is disputed.

Affected

• SGLang 0.5.10 through 0.5.22
• Only deployments with the debug dumper server enabled (DUMPER_SERVER_PORT set)
• Versions before 0.5.10: Unknown.

Fixed in

Unknown. No vendor-confirmed fixed release found. Fix work is in open pull requests (#45998, #44782); their merge status is unclear.

Workaround

• Ensure DUMPER_SERVER_PORT is unset in every deployment
• Restrict network access to the SGLang API to trusted hosts; do not expose it to the internet
• Block the /dumper/ routes at a reverse proxy or firewall if the dumper must remain enabled
• No vendor mitigation published.

Exploitation

• Public proof of concept: yes, documented in GitHub issue #44188
• In the wild: No evidence found
• CISA SSVC: exploitation PoC, automatable: no, technical impact: total
• EPSS is low (0.00452)
• Not listed in CISA KEV (per research)

Our recommendation

• Inventory all SGLang installations, including PyPI sglang packages
• Check whether DUMPER_SERVER_PORT is set and disable the dumper if not needed
• Restrict access to SGLang endpoints to trusted hosts immediately
• Monitor the GitHub issue and pull requests and upgrade once a fixed release is published
• Review the scheduler host for unexpected files or processes if exposure existed

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record: VulnCheck advisory www.vulncheck.com
• GitHub issue #44188 github.com
• dumper.py at v0.5.22 (vulnerable code) github.com
• SGLang repository github.com
• Pull request #45998 (eval replacement) github.com
• Pull request #44782 (hardening attempt) github.com
• VulDB entry 421267 vuldb.com
• SUSE CVE record via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:22.