Summary
SGLang's multimodal generation runtime deserializes attacker-controlled data with Python's unsafe pickle mechanism on an unauthenticated network socket. An unauthenticated remote attacker who can reach the exposed service may execute arbitrary code in the runtime process.
Affected context
The vulnerability occurs in SGLang deployments using the disaggregated-diffusion orchestrator when its DiffusionServer exposes a ZeroMQ ROUTER socket on a reachable network interface without authentication. Risk is highest when the socket is accessible beyond a tightly controlled internal boundary and received multipart messages are processed before validation.
Exploit preconditions
- Attack surface: Network-reachable ZeroMQ ROUTER socket exposed by the DiffusionServer
- Required access: No application authentication is required when the socket is reachable
- Trigger point: Processing of the final frame in a received multipart message
- Why exploitation is possible: The frame is passed directly to
pickle.loads()before validation, allowing serialized data to control object reconstruction
Why this happens
The underlying flaw is unsafe deserialization of untrusted network data. Python pickle deserialization can reconstruct objects through behavior that is not limited to passive data parsing, so applying pickle.loads() to attacker-controlled bytes can invoke unintended code during object reconstruction. This behavior maps to CWE-502: Deserialization of Untrusted Data, compounded by the absence of authentication and input validation at the network boundary.
Potential impact
- An unauthenticated attacker could execute arbitrary code in the SGLang service process
- The attacker may access or alter model, prompt, and generated-output data available to that process
- The runtime could be used for lateral movement or further compromise of the host environment
- Service availability may be disrupted through malicious or malformed messages
- Compromised runtime privileges could enable broader impact depending on deployment permissions
General mitigation guidance
Mitigation generally focuses on removing unsafe deserialization from network-facing paths and reducing trust in inter-process messages.
Common defensive patterns include:
- Prefer data-only serialization formats with explicit schemas and no executable object reconstruction
- Require authentication and authorization for ZeroMQ endpoints
- Bind service sockets only to necessary interfaces and isolate them from untrusted networks
- Validate message structure, types, size, and origin before processing
- Apply network segmentation and deny-by-default firewall policies
- Run inference workers with least privilege, restricted filesystem access, and limited network permissions
- Treat serialized messages as untrusted even when they originate from internal services
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving
pickle.loads(),pickle.load(), or equivalent unsafe deserialization APIs on network-derived data - Code review signals showing raw multipart message frames passed into deserializers without authentication or schema validation
- Service configurations that bind ZeroMQ sockets to broad interfaces or expose them outside an intended trust boundary
- Network telemetry showing unexpected clients connecting to DiffusionServer endpoints
- Runtime monitoring for anomalous child processes, filesystem access, or outbound connections from inference workers
- Policy enforcement that blocks unsafe serialization APIs in network-facing components and requires authenticated service-to-service communication
