arbor-ai (0.1.13), coreason-runtime (>=0.1.0, <=0.10.8) +7 more potentially affected by CVE-2026-7669 via sglang (>=0.1.26, <=0.5.2)

sglang PYPI version =0.1.26, =0.1.0, =1.1.0rc1, =0.4.0, =0.0.1, =0.0.1.post1, =0.0.0, =0.8.0, =0.10.9 Source cves: CVE-2026-7669 Source advisory: OSV:PYSEC-2026-3062...

CVE-2026-7669

creationtimestamp| type| source ---|---|--- 2026-05-04 01:00:38+00:00| seen| https://t.me/GithubRedTeam/82694 2026-05-04 09:00:04+00:00| seen| Telegram/XcvE3DqJ3gfHbHlWBgCF8vzzdw-S4AP1Zm7AyYzHhyXEw...

CVE-2026-7669 sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection

A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function gettokenizer of the file python/sglang/srt/utils/hftransformersutils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trustremotecode with the input False as part of Boole...