CVE-2026-7304

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will be deserialized without validation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: May 18, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-730408.8Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to mat CVE-2026-730419.0SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can CVE-2026-730429.0SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when us CVE-2026-730439.0SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authore CVE-2026-730449.0SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into styl CVE-2026-730457.5SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoin CVE-2026-730469.8SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication bra CVE-2026-730476.2siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation CVE-2026-730485.8SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block CVE-2026-730495.8SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the fo CVE-2026-73056.3A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src CVE-2026-730509.0SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site script