2 matches found
CVE-2026-15976
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /updateweightsfromdisk, where torch.load..., weightsonly=False fallback enables pickle deserialization of .bin files...
9.8CVSS5.9AI score0.00604EPSS
SaveExploits0References4
CVE-2026-15976: Deserialization of Untrusted Data
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /updateweightsfromdisk, where torch.load..., weightsonly=False fallback enables pickle deserialization of .bin files...
9.8CVSS6AI score0.00604EPSS
SaveExploits0References4
20