CVE-2026-111391 Details

A code injection vulnerability has been identified in SGLang versions 0.5.10 through 0.5.22. The issue arises in the `_evaluate_filter()` function, where remote attackers can execute Python code by manipulating the `eval()` sandbox. This is achieved by exploiting the `re.search` function's `__globals__` attribute to access the global namespace and execute arbitrary code. The vulnerability can be exploited by sending a crafted filter expression to the unauthenticated `/dumper/configure` endpoint, while the `DUMPER_SERVER_PORT` is set to `reuse`. The injected code is executed in the scheduler process during the next model inference pass.

Users can update to SGLang version 0.5.23 or later, where this vulnerability has been fixed.