SGLang Code Injection Flaw Allows Remote Execution in Scheduler

The open-source inference engine SGLang contains a critical code injection vulnerability that allows remote attackers to execute arbitrary Python code. This flaw, identified as CVE-2026-111391, affects versions of the software up to and including 0.5.22. The vulnerability enables an attacker to bypass security restrictions and run commands within the scheduler process.

According to the National Vulnerability Database record, the issue stems from the _evaluate_filter() function. Attackers can exploit this by sending a crafted filter expression to the unauthenticated /dumper/configure endpoint. This action is possible only when the DUMPER_SERVER_PORT environment variable is set on the server. The exploit allows the attacker to escape the eval() sandbox by leveraging the re.search __globals__ attribute.

Technical Context and Impact

The vulnerability is classified with a CVSS score of 9.2, which falls into the critical severity range. It is categorized under CWE-95, which denotes improper neutralization of directives during data evaluation. This specific weakness allows an attacker to inject malicious code that is then executed by the application.

The exploit targets the scheduler process of the SGLang engine. Once the crafted filter expression is processed, the malicious Python code runs during the next forward pass. This means the attacker does not need to authenticate to the system to trigger the execution. The unauthenticated nature of the endpoint significantly increases the risk of exploitation.

This incident follows a trend of severe vulnerabilities in software infrastructure. As Threat Times reported on 2026-10-16, a critical code injection flaw was found in The Grid WordPress plugin. Similarly, on 2026-10-15, Threat Times reported a critical server-side template injection flaw in SolusVM 2. These reports highlight the ongoing risks of code injection vulnerabilities in widely used software components.

Affected Systems and Scope

The vulnerability affects all versions of SGLang from 0.5.10 through 0.5.22. The sgl-project maintains this software, which is used for large language model inference. Any deployment using these versions is potentially at risk if the specific configuration conditions are met.

The primary condition for exploitation is the presence of the DUMPER_SERVER_PORT setting. If this environment variable is not set, the specific attack vector via the /dumper/configure endpoint is likely unavailable. However, administrators cannot assume their systems are safe without verifying this configuration. The remote nature of the attack means it can be initiated from any network location with access to the port.

What should you do?

Administrators should immediately verify if their SGLang installations are running versions between 0.5.10 and 0.5.22. If so, they must check whether the DUMPER_SERVER_PORT environment variable is configured on their servers. If the variable is set, the risk of remote code execution is active.

Since no patch or update has been confirmed in the source material, the immediate mitigation strategy involves configuration changes. Organizations should consider disabling the DUMPER_SERVER_PORT if it is not strictly required for their operations. This removes the unauthenticated endpoint that attackers exploit to inject code.

Network segmentation can also help limit exposure. Restricting access to the port associated with the dumper server can prevent remote attackers from reaching the vulnerable endpoint. Monitoring logs for unusual activity on this endpoint may also provide early warning of exploitation attempts.