CVE-2026-93088

UNKNOWN 0.0

CVE-2026-93088

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.

Vendor	sglang
Product	sglang
Published	Sep 22, 2026
Last Updated	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for sglang sglang

Be the first to know when new unknown vulnerabilities affecting sglang sglang are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

SGLang / SGLang

0.5.11 ≤ 0.5.14

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hacchoomiso.github.io: https://hacchoomiso.github.io/blog/SGLang/CVE-2026-93088/ github.com: https://github.com/sgl-project/sglang/blob/main/python/sglang/multimodal_gen/runtime/disaggregation/orchestrator.py