{"id":"CVE-2026-93088","aliases":["EUVD-2026-84408","GHSA-xv76-mrpv-26pg","openSUSE-SU-2026:11865-1"],"status":"published","title":"CVE-2026-93088","description":"SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00725,"percentile":0.54537,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2026-09-22T14:07:45Z","modified":"2026-10-28T02:30:40Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-sglang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.20-1.1"}]}],"bundled":5}],"products":[{"vendor":"sgl-project","product":"sglang"},{"vendor":"sglang","product":"sglang"}],"references":[{"url":"https://hacchoomiso.github.io/blog/SGLang/CVE-2026-93088/","tags":["exploit","article"]},{"url":"https://github.com/sgl-project/sglang/blob/main/python/sglang/multimodal_gen/runtime/disaggregation/orchestrator.py","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93088","tags":["advisory"]},{"url":"https://hacchoomiso.github.io/blog/SGLang/CVE-2026-93088"},{"url":"https://github.com/advisories/GHSA-xv76-mrpv-26pg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93088.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94570","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-93088","title":"CVE-2026-93088","description":"SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.","status":"published","published":"2026-09-22T14:07:45.629Z","modified":"2026-09-22T18:45:48.365Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-84408","description":"SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.","status":"published","published":"2026-09-22T14:07:45Z","modified":"2026-09-22T18:45:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:02.149692Z"}],"ghsa":[{"id":"GHSA-xv76-mrpv-26pg","title":"SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution...","description":"SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.","status":"published","published":"2026-09-22T15:32:41Z","modified":"2026-09-22T21:31:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:12:18.539197Z"}],"nvd":[{"id":"CVE-2026-93088","description":"SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.","status":"published","published":"2026-09-22T15:17:21.433Z","modified":"2026-09-22T19:16:57.45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"CVE-2026-93088","title":"CVE-2026-93088","description":"SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.","status":"published","published":"2026-09-22T14:07:45.629Z","modified":"2026-10-28T02:30:40.914351637Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:20.588039Z"},{"id":"openSUSE-SU-2026:11865-1","title":"python313-sglang-0.5.20-1.1 on GA media","description":"These are all security issues fixed in the python313-sglang-0.5.20-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-09-24T18:23:14.723429122Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}