Why it matters
This is a classic and highly dangerous supply-chain-style attack surface for ML infrastructure: any organization that lets SGLang pull model weights from an external or user-supplied HuggingFace repo (a very common MLOps pattern) can be fully compromised by a malicious .bin file, with no further authentication needed beyond triggering the weight-update path. CERT/CC additionally documented five related SGLang CVEs (credential leakage via /server_info, unauthenticated RCE via /load_lora_adapter_from_tensors bypassing SafeUnpickler, and a dumper-subsystem sandbox escape), indicating a systemic deserialization/sandboxing weakness across the SGLang codebase.
Attack vector
SGLang's /update_weights_from_disk endpoint falls back to torch.load(..., weights_only=False) when loading .bin model weight files from a HuggingFace repository, enabling pickle deserialization of attacker-controlled data and resulting in remote code execution on the inference server.
Affected systems
SGLang model-serving engine
Mitigation
Update SGLang per the GHSA-wf98-gv64-5wrf advisory; avoid weights_only=False fallback paths, restrict which repositories/users can trigger weight reloads, and treat any externally-sourced model weights as untrusted input requiring safetensors-only loading.