CVE-2026-7669

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7669", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-02T08:00:13.701Z", "datePublished": "2026-05-02T22:00:19.859Z", "dateUpdated": "2026-05-05T00:31:40.051Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-04T04:21:53.695Z"}, "title": "sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "sgl-project", "product": "SGLang", "versions": [{"version": "0.5.0", "status": "affected"}, {"version": "0.5.1", "status": "affected"}, {"version": "0.5.2", "status": "affected"}, {"version": "0.5.3", "status": "affected"}, {"version": "0.5.4", "status": "affected"}, {"version": "0.5.5", "status": "affected"}, {"version": "0.5.6", "status": "affected"}, {"version": "0.5.7", "status": "affected"}, {"version": "0.5.8", "status": "affected"}, {"version": "0.5.9", "status": "affected"}], "modules": ["HuggingFace Transformer Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller's explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode=\"auto\" and tokenizer_mode=\"slow\" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.6, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-07T02:00:00.000Z", "lang": "en", "value": "Vulnerability found"}, {"time": "2026-04-07T02:00:00.000Z", "lang": "en", "value": "Vendor informed"}, {"time": "2026-05-02T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-02T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-03T02:00:00.000Z", "lang": "en", "value": "Exploit disclosed"}, {"time": "2026-05-04T06:26:28.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Nicholas Gould", "type": "finder"}, {"lang": "en", "value": "David Rochester", "type": "finder"}, {"lang": "en", "value": "ngould (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "ngould (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/360817", "name": "VDB-360817 | sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection", "tags": ["vdb-entry", "technical-description", "exploit"]}, {"url": "https://vuldb.com/vuln/360817/cti", "name": "VDB-360817 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/799263", "name": "Submit #799263 | sgl-project sglang <=0.5.9 Protection Mechanism Failure", "tags": ["third-party-advisory"]}, {"url": "https://github.com/gouldnicholas/CVE-2026-7669-PoC", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-05T00:31:25.310003Z", "id": "CVE-2026-7669", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T00:31:40.051Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7669", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-05T00:31:25.310003Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T00:31:35.648Z"}}], "cna": {"title": "sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection", "credits": [{"lang": "en", "type": "finder", "value": "Nicholas Gould"}, {"lang": "en", "type": "finder", "value": "David Rochester"}, {"lang": "en", "type": "reporter", "value": "ngould (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "ngould (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "sgl-project", "modules": ["HuggingFace Transformer Handler"], "product": "SGLang", "versions": [{"status": "affected", "version": "0.5.0"}, {"status": "affected", "version": "0.5.1"}, {"status": "affected", "version": "0.5.2"}, {"status": "affected", "version": "0.5.3"}, {"status": "affected", "version": "0.5.4"}, {"status": "affected", "version": "0.5.5"}, {"status": "affected", "version": "0.5.6"}, {"status": "affected", "version": "0.5.7"}, {"status": "affected", "version": "0.5.8"}, {"status": "affected", "version": "0.5.9"}]}], "timeline": [{"lang": "en", "time": "2026-04-07T02:00:00.000Z", "value": "Vulnerability found"}, {"lang": "en", "time": "2026-04-07T02:00:00.000Z", "value": "Vendor informed"}, {"lang": "en", "time": "2026-05-02T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-02T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-03T02:00:00.000Z", "value": "Exploit disclosed"}, {"lang": "en", "time": "2026-05-04T06:26:28.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/360817", "name": "VDB-360817 | sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection", "tags": ["vdb-entry", "technical-description", "exploit"]}, {"url": "https://vuldb.com/vuln/360817/cti", "name": "VDB-360817 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/799263", "name": "Submit #799263 | sgl-project sglang <=0.5.9 Protection Mechanism Failure", "tags": ["third-party-advisory"]}, {"url": "https://github.com/gouldnicholas/CVE-2026-7669-PoC", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller's explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode=\"auto\" and tokenizer_mode=\"slow\" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-04T04:21:53.695Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7669", "state": "PUBLISHED", "dateUpdated": "2026-05-05T00:31:40.051Z", "dateReserved": "2026-05-02T08:00:13.701Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-02T22:00:19.859Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["HuggingFace Transformer Handler"], "product": "SGLang", "vendor": "sgl-project", "versions": [{"status": "affected", "version": "0.5.0"}, {"status": "affected", "version": "0.5.1"}, {"status": "affected", "version": "0.5.2"}, {"status": "affected", "version": "0.5.3"}, {"status": "affected", "version": "0.5.4"}, {"status": "affected", "version": "0.5.5"}, {"status": "affected", "version": "0.5.6"}, {"status": "affected", "version": "0.5.7"}, {"status": "affected", "version": "0.5.8"}, {"status": "affected", "version": "0.5.9"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller's explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode=\"auto\" and tokenizer_mode=\"slow\" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en sgl-project SGLang hasta la versi\u00f3n 0.5.9. Afectada est\u00e1 la funci\u00f3n get_tokenizer del archivo python/sglang/srt/utils/hf_transformers_utils.py del componente Gestor de Transformadores HuggingFace. La manipulaci\u00f3n del argumento trust_remote_code con la entrada False como parte de Booleano resulta en inyecci\u00f3n de c\u00f3digo. El ataque puede ser ejecutado remotamente. Un alto nivel de complejidad est\u00e1 asociado con este ataque. La explotabilidad se considera dif\u00edcil. En get_tokenizer(), cuando el llamador pasa trust_remote_code=False y HuggingFace transformers v5 devuelve una instancia de TokenizersBackend (el mecanismo de reserva gen\u00e9rico para clases de tokenizador no en el registro), SGLang vuelve a invocar silenciosamente AutoTokenizer.from_pretrained con trust_remote_code=True, anulando la configuraci\u00f3n de seguridad expl\u00edcita del llamador. Un repositorio de modelos que contiene un tokenizer.py malicioso referenciado a trav\u00e9s de auto_map en tokenizer_config.json ejecutar\u00e1 Python arbitrario en el proceso de SGLang durante esta segunda llamada. Ninguna l\u00ednea de registro o advertencia es emitida. La anulaci\u00f3n afecta a todas las versiones actuales de SGLang porque transformers==5.3.0 est\u00e1 fijado en pyproject.toml. Tanto tokenizer_mode=\u2019auto\u2019 como tokenizer_mode=\u2019slow\u2019 est\u00e1n afectados. El exploit ahora es p\u00fablico y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-7669", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7669", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-05T00:31:25.310003Z", "version": "2.0.3"}}]}, "published": "2026-05-02T22:16:24.080", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/gouldnicholas/CVE-2026-7669-PoC"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/799263"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360817"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360817/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.9"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "sglang", "vendor": "sgl-project"}], "created": "2026-05-02T23:30:05.891026+00:00", "updated": "2026-05-04T16:06:45.016712+00:00", "vendors": ["sgl-project", "sgl-project$PRODUCT$sglang"]}