CVE-2026-5760
Published: 20 April 2026
Summary
CVE-2026-5760 is a critical-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates and sanitizes chat_template content from loaded model files to prevent code injection via malicious Jinja2 templates in the reranking endpoint.
Enforces secure configuration settings for the Jinja2 environment to enable sandboxing, directly preventing RCE from unsandboxed template rendering.
Remediates the specific flaw in SGLang's reranking endpoint by applying vendor patches or updates that address unsandboxed Jinja2 rendering.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated RCE via exploitation of public-facing reranking endpoint (T1190) through code injection in unsandboxed Jinja2 chat templates (T1221).
NVD Description
SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().
Deeper analysisAI
CVE-2026-5760, published on 2026-04-20, is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting SGLang's reranking endpoint (/v1/rerank). It enables remote code execution (RCE) when a model file containing a malicious tokenizer.chat_template is loaded, as Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment(). The issue is classified under CWE-94 (code injection).
An unauthenticated attacker with network access can exploit the vulnerability with low attack complexity and no user interaction. By triggering the loading of a model file with a malicious chat template via the reranking endpoint, the attacker achieves arbitrary remote code execution, compromising confidentiality, integrity, and availability to a high degree.
Mitigation details are available in related advisories, including the GitHub proof-of-concept repository at https://github.com/Stuub/SGLang-0.5.9-RCE and the CERT vulnerability note at https://www.kb.cert.org/vuls/id/915947.
Details
- CWE(s)