Watch card · compiled automatically, not analysed
CVE-2026-111391
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the…
AI summarySGLang 0.5.10–0.5.22 lets remote attackers run Python code via a crafted filter sent to the unauthenticated /dumper/configure endpoint.
Our research pipeline compiles this page from public data. It contains no human judgement from PlainCVE; rely on the original advisories for facts.
Our status
Written up — We have written this up; read the full analysis. Read the write-up →
Key numbers
- CVSS
- 9.2 v4.0
- CISA KEV
- Not listed
- EPSS
- 0.45%
- Momentum
- —
Timeline
- 2026-10-16DisclosedNVD
How much time similar vulnerabilities gave
This item is not mapped to a category yet, so here are the overall numbers: of 390 vulnerabilities disclosed since 2025 and added to KEV, the median time from disclosure to KEV was 5 days; 54% were added within 7 days.
This one: not in KEV so far (that does not mean it is not exploited).
Counts only vulnerabilities CISA has confirmed as exploited; disclosure is the NVD publication date, which can differ from the vendor advisory.
Primary sources
Watch cards update with This week every 3 hours. Once we write this up, this URL will point to the write-up.