What happened
VulnCheck disclosed (2026-10-16) a CWE-95 code-injection in SGLang's debug-dumper filter evaluation. The endpoint is unauthenticated when the dumper server is enabled, and injected Python detonates in the scheduler process — the process that owns the model serving the forward passes — rather than in the HTTP handler, so the payload lands with the serving engine's full privileges. CISA SSVC marks exploitation=poc, technicalImpact=total (NVD REST verified).
Why it matters
This is unauthenticated remote code execution inside a widely deployed LLM inference engine's control plane. A compromised scheduler can read model weights, API keys, and tenant request data, tamper with generation output, or hijack the serving process for persistence — turning an LLM serving cluster into an attacker foothold. The delayed-detonation design (runs on next forward pass) also makes the exploitation hard to attribute.
Attack vector
An unauthenticated attacker who can reach the /dumper/configure endpoint submits a crafted filter expression. _evaluate_filter() evaluates it with eval(); the expression escapes via re.search.__globals__ to reach __builtins__, and executes arbitrary Python on the next forward pass inside the scheduler process that drives model inference. Dumper server only enabled when DUMPER_SERVER_PORT is set (hence CVSS attack-complexity High / 8.1 v3.1, 9.2 v4.0).
Affected systems
SGLang 0.5.10 through 0.5.22 (python/sglang/srt/debug_utils/dumper.py)
Mitigation
Disable the debug dumper unless explicitly needed and never expose /dumper/configure to the network; audit deployments that set DUMPER_SERVER_PORT. Track upstream issue #44188 and GHSA-vfgj-p7f7-r3v8 for the patch status (none published as of verification). VulnCheck advisory: https://www.vulncheck.com/advisories/sglang-0.5.10-through-0.5.22-code-injection-via-debug-dumper-filter