SGLang: Remote code execution via unsafe pickle deserialization in ZMQ decoder
Summary
SGLang's internal ZeroMQ message decoder passes PickleWrapper payloads to pickle.loads() without a type allowlist or authentication. The flaw persists on the MessagePack path even when SGLANG_USE_PICKLE_IPC is disabled, so turning off pickle transport does not remove it. An unauthenticated attacker who can reach the internal receiver can run arbitrary code with the privileges of the SGLang process, which is remotely exploitable when data-parallel attention is enabled with a non-loopback --dist-init-addr.
Affected
- SGLang versions 0 to 0.5.20 (per CVE record and CISA SSVC; exact range not confirmed by vendor)
- Remote exploitation requires data-parallel attention enabled and a non-loopback --dist-init-addr
- Unknown whether default settings are affected
Fixed in
Unknown. No fixed version or vendor advisory was found at the time of writing.
Workaround
- Keep the --dist-init-addr bound to loopback
- Keep ZMQ data-parallel attention sockets off untrusted networks
- Avoid the MessagePack path; disabling SGLANG_USE_PICKLE_IPC alone does not remove the exposure
- Restrict network access to SGLang internal ports with firewall rules, allowing only the local host
Exploitation
- CISA SSVC: exploitation none, automatable yes, total technical impact
- No known exploitation in the wild found at the time of writing
- No public proof of concept confirmed; a technical write-up describes code execution in a test setup
Our recommendation
- Inventory all SGLang deployments and their versions
- Check whether data-parallel attention is enabled and what --dist-init-addr is bound to
- Restrict network access to SGLang internal ports immediately
- Monitor the sgl-project repository and NVD for an advisory and fixed release, then update promptly
- Treat any exposed deployment as critical given the CVSS score of 9.8
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SGLang GitHub repository github.com
- m00dy.sh: Disabling Pickle Did Not Remove Pickle m00dy.sh
- Forkast: SGLang CVSS 9.8 pickle deserialization RCE forkast.news
- Strix: CVE-2026-93034 www.strix.ai
- CERT/CC VU#665416 advisory kb.cert.org
- Vulners: CVE-2026-93034 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:25.
Original description (NVD)
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.