SGLang debug dumper eval injection: a filter expression can escape the sandbox and run arbitrary Python in the scheduler process

Who is affected

The reporter reproduced the issue on 0.5.19.

sglang 0.5.22 was uploaded to PyPI on 2026-10-16 and has not been yanked, so it is a published release (PyPI release metadata).

Authentication depends on the mode: the CVE record (published by VulnCheck, not the SGLang project) calls /dumper/configure unauthenticated; the reporter says it needs no login only when no API key is configured. Tracing this to the v0.5.22 code, the two accounts describe different modes rather than contradicting each other. With a numeric DUMPER_SERVER_PORT, the dumper starts a separate HTTP server bound to 0.0.0.0 (all network interfaces) that performs no authentication check. With reuse, the dumper routes sit on the main API and, per the reporter and the researcher, follow the main server’s admin policy (without an admin_api_key, anyone holding an ordinary key can exploit it).

Separately, a researcher notes that in the versions they reviewed, the main SGLang server binds to loopback by default, meaning only the same machine can connect. That only protects reuse mode: the same write-up and the v0.5.22 code show the numeric-port dumper server binds to all network interfaces, which a loopback-only main server does not prevent.

How it works

SGLang is an open-source framework, hosted by LMSYS, for serving large language models. It has an optional “debug dumper” that records internal data while the model runs. Through the /dumper/configure endpoint, a user can set a “filter expression” that decides what gets recorded.

The problem is in a function called _evaluate_filter(): it checks the filter using Python’s eval(), a built-in that runs a piece of text as code. The developers ran it in a restricted environment that offers only a few helpers, such as re.search. But a Python function object carries a link to its module’s global variables, and an attacker can follow that link to reach things they shouldn’t, escaping the restriction. This kind of weakness is called eval injection (CWE-95).

The injected code doesn’t run right away. It runs inside SGLang’s scheduler process the next time a model execution (forward pass) reaches a dumper hook. The reporter says this code can read the model files, mounted credentials, environment variables and process memory available to the scheduler.

The flawed approach (conceptual illustration, not the original source code):

# The restricted environment still contains function objects, which can lead back to much more
def evaluate_filter(expr, record):
    return eval(expr, {"__builtins__": {}, "re": some_regex_helpers}, record)

A safer approach:

import ast
ALLOWED = (ast.Expression, ast.Compare, ast.BoolOp, ast.Name, ast.Constant, ...)

def evaluate_filter(expr, record):
    tree = ast.parse(expr, mode="eval")
    for node in ast.walk(tree):
        if not isinstance(node, ALLOWED):
            raise ValueError("syntax not allowed")
        # Always reject double-underscore attributes, and expose no function objects
    return safe_interpret(tree, record)  # interpret it yourself; never call eval

This matches the reporter’s advice: don’t evaluate the filter with eval; use a structured parser or a restricted evaluator that exposes no function objects. A commenter who is not a maintainer opened PR #44205 to replace eval with a whitelist-based AST evaluator. A maintainer closed that PR without merging it (closing it together with the other PRs the same account opened, 37 in a short period, citing insufficient validation and testing), so it does not count as a fix.

Timeline

Further reading

• Scoring differences: the CVE record lists a CVSS 4.0 score of 9.2 (Critical) and a CVSS 3.1 score of 8.1 (High). They just use different scoring versions. NVD has marked the CVE “Deferred,” meaning it has done no analysis of its own, so this page uses the CVE record’s score.
• Exploitation: CISA’s SSVC assessment rates exploitation as “poc,” meaning a public proof of concept exists; public GitHub issue #44188 also includes a reproduction (that page contains exploit code; we do not link it). The EPSS score (an estimate of the chance of exploitation in the next 30 days) recorded by the GitHub Advisory Database is about 0.45%. No source reports exploitation in the wild, and none reports zero-day exploitation.
• Related CVE: the earlier CVE-2026-15971 (assigned by CERT/CC) describes a dumper sandbox escape when DUMPER_SERVER_PORT is set, listing versions up to v0.5.15 (published 2026-07-30); that record does not mention _evaluate_filter or re.search. Our analysis is that the new CVE may describe the same flaw in later versions, or an incomplete fix of it, but no source confirms how the two relate.
• Credits: the CVE record credits Jiapeng Li, Jiajia Liu, Qiang Fu and Jiadai Wang.
• Related weakness type: CWE-95 (eval injection).