CVE-2026-3989

HighCVSS 7.8/10Last modified Aug 10, 2026

Description

SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
SGLang	SGLang	0.5.10

References

https://github.com/sgl-project/sglang/blob/main/scripts/playground/replay_request_dump.pyProduct
https://github.com/sgl-project/sglang/pull/20904Issue Tracking, Patch
https://github.com/sgl-project/sglang/releases/tag/v0.5.10Release Notes
https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities/Exploit, Third Party Advisory

Timeline

Published: Mar 12, 2026
Last modified: Aug 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-398909.8PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML CVE-2026-398918.8PraisonAI is a multi-agent teams system. Prior to 4.5.115, the create_agent_centric_tools() function returns tools (like acp_create_file) th CVE-2026-398929.8cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a n CVE-2026-398939.8Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatena CVE-2026-398942.5Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in CVE-2026-398976.1Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the h CVE-2026-398995.3Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal via filename CVE-2026-39904.3A security flaw has been discovered in CesiumGS CesiumJS up to 1.137.0. Affected by this issue is some unknown functionality of the file App CVE-2026-399006.1Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parame CVE-2026-399015.7monetr is a budgeting application focused on planning for recurring expenses. Prior to 1.12.3, a transaction integrity flaw allows an authen CVE-2026-399027.2Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted sin CVE-2026-399037.1Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/