Summary
SGLang's optional dumper subsystem contains a remote code execution flaw where dynamically evaluated code can be triggered via inference requests when DUMPER_SERVER_PORT is set.
In environments where the dumper is enabled and exposed, an attacker who can control or influence inference requests may escape the sandbox and execute arbitrary code on the host running SGLang.
Affected context
This vulnerability arises in SGLang deployments that enable the optional dumper subsystem and configure a listening port via DUMPER_SERVER_PORT.
It is most relevant in multi-tenant or externally exposed inference environments where untrusted or semi-trusted inference requests are accepted.
The risk increases when dumper endpoints are reachable over the network and are granted access to the underlying runtime or filesystem outside the normal model sandbox.
Exploit preconditions
- Attack surface: Network-accessible dumper or inference endpoint associated with SGLang
- Required access: Ability to send or influence inference requests processed when the dumper subsystem is active
- Trigger point: Handling of requests while
DUMPER_SERVER_PORTis set and the dumper server is running - Why exploitation is possible: The dumper subsystem evaluates or executes code derived from request data without adequate isolation or validation, enabling direct execution in the host runtime context
Why this happens
The underlying bug class is unsafe dynamic code evaluation, mapped to CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection').
When the dumper subsystem is enabled, it appears to use mechanisms such as interpreter evaluation or command execution based on incoming request content, without robust filtering or confinement.
This design allows attacker-controlled inputs to be interpreted as executable instructions, breaking the intended sandbox boundary around inference logic and granting code execution privileges within the hosting process.
Potential impact
- Execution of arbitrary code on the host running SGLang
- Complete compromise of the inference service and its data
- Pivoting from the model runtime to other services or infrastructure
- Unauthorized access to secrets, environment variables, or configuration
- Denial of service by crashing or corrupting the inference environment
General mitigation guidance
Mitigation generally focuses on reducing trust in dynamically interpreted inputs and isolating optional subsystems:
- Prefer disabling optional components like the dumper subsystem in environments that handle untrusted or multi-tenant inference traffic.
- Avoid designs where inference inputs or metadata are directly fed into generic evaluators, interpreters, or shell-like execution paths.
- Introduce strict validation and normalization layers that treat all external inputs as untrusted data, never as executable directives.
- Constrain auxiliary services such as dumpers to least-privilege execution contexts, using process isolation, containers, or restricted users to limit damage if they misbehave.
- Implement strong network-level access controls so that diagnostic or debugging ports are not exposed to untrusted networks.
How teams detect issues like this
Detection efforts can combine code-centric and operational approaches:
- Use static analysis to flag uses of dynamic evaluation functions (e.g.,
eval,exec, generic interpreters) that consume request-derived data within the dumper or similar subsystems. - During code review, scrutinize any logging, debugging, or "dumper" features that interpret or replay user inputs, especially where environment variables such as
DUMPER_SERVER_PORTcontrol exposure. - Enforce internal security policies requiring that optional debugging endpoints be authenticated, restricted, or disabled by default in production.
- Monitor runtime logs and telemetry for anomalous requests that appear to inject scripting constructs or commands into inference or dumper paths.
