CVE-2026-5760

CVE-2026-5760 is a critical remote code execution vulnerability affecting SGLang's reranking endpoint (/v1/rerank), which occurs when model files containing malicious tokenizer.chat_template configurations are loaded. The vulnerability stems from unsafe rendering of Jinja2 chat templates using an unsandboxed jinja2.Environment(), allowing attackers to execute arbitrary code on affected systems. This vulnerability impacts any deployment utilizing SGLang's reranking functionality with untrusted model files. The vulnerability carries a CVSS score of 9.8 (CRITICAL) with a network-based attack vector requiring no authentication, low complexity, and no user interaction, resulting in complete compromise of confidentiality, integrity, and availability. The attack surface is maximized as the vulnerability can be exploited remotely by any unauthenticated threat actor without special conditions or prerequisites. While the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, it remains on the active Hot List indicating ongoing community attention and concern. The EPSS score of 0.002870000 suggests relatively low current exploitation prevalence compared to other CVEs, though this should not diminish the critical nature of the vulnerability given its severity rating and potential impact on compromised systems. Organizations running SGLang should prioritize patching and implement network controls restricting access to the reranking endpoint.