Loading story…
A critical remote code execution vulnerability in the SGLang platform for multimodal AI models has been disclosed as CVE-2026-5760, with a CVSS 9.8 severity rating. The flaw affects the /v1/rerank endpoint and allows attackers to inject commands and execute arbitrary Python code in the context of the SGLang service by supplying a malicious tokenizer.chat_template during chat template rendering.
Public proof-of-concept exploit code is available, increasing the risk of active abuse before a vendor patch is released. According to the disclosure, the issue stems from use of an unsandboxed jinja2.Environment(), and CERT/CC has recommended replacing it with ImmutableSandboxedEnvironment as a mitigation until an updated SGLang version becomes available.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported that CVE-2026-5760 affects SGLang's /v1/rerank endpoint, enabling command injection and arbitrary Python code execution via a malicious tokenizer.chat_template rendered in an unsandboxed jinja2.Environment(). The advisory also noted that public proof-of-concept exploit code is available and relayed CERT-CC's mitigation to use ImmutableSandboxedEnvironment until a patched version is released.
A CVE record for CVE-2026-5760 was published, documenting a critical remote code execution vulnerability affecting SGLang.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-25879**, a critical vulnerability in the Langroid Python framework that lets attackers use prompt injection to steer the `SQLChatAgent` component into executing malicious LLM-generated SQL. The flaw can bypass intended input restrictions and abuse database-specific primitives, potentially escalating from SQL manipulation to **remote code execution** on the database host. Reported impacts include arbitrary command execution, data exfiltration, destructive database changes, and possible lateral movement, and the issue was rated **CVSS 9.8**. The exposure affects Langroid versions prior to **0.63.0** and is most severe when the application connects with highly privileged database roles, including capabilities such as PostgreSQL `pg_execute_server_program`, MySQL `FILE`, or MSSQL `xp_cmdshell`. Researchers also warned that exploitation may occur through indirect attacker influence over data returned to the LLM, not only through direct user prompts. Langroid patched the issue in version **0.63.0** by enforcing a strict `SELECT`-only allowlist parsed with `sqlglot` and adding a dialect-aware blocklist for dangerous patterns, while still permitting trusted deployments to restore broader behavior with `allow_dangerous_operations=True`.
Jun 29, 2026
A critical vulnerability in the LangChain-based no-code LLM development platform **Langflow** exposed internet-facing instances to unauthenticated remote code execution. Tracked as **`CVE-2025-3248`** and rated **CVSS 9.8**, the flaw was disclosed after researchers showed that unsafe use of Python `exec` could be abused through Langflow's code-validation functionality, allowing attackers to run arbitrary Python on vulnerable servers. Security monitoring by MBSD-SOC found exploitation attempts beginning on **April 10, 2025**, shortly after public disclosure on April 8. Attackers were observed sending crafted `POST` requests to the **`/api/v1/validate/code`** endpoint to execute malicious Python, including attempts to read sensitive files such as **`/etc/passwd`**. The report said proof-of-concept code and real-world abuse were already circulating, and urged organizations to update Langflow immediately; telemetry cited the **Netherlands** and **France** as the source of roughly half of observed attack traffic.
Aug 15, 2026
A critical unauthenticated remote code execution flaw in Langflow, tracked as **`CVE-2026-0770`**, has been actively exploited against the platform’s `/api/v1/validate/code` endpoint. The vulnerability affects Langflow versions **0.0.31 through 1.7.3** and stems from unsafe use of Python’s `exec()` during server-side code validation, allowing attackers to submit crafted function definitions that execute arbitrary operating system commands. Reported post-exploitation activity included reconnaissance, credential theft, environment-variable collection, cloud metadata access, and retrieval of second-stage payloads. CISA added **`CVE-2026-0770`** to its **Known Exploited Vulnerabilities** catalog and directed U.S. federal civilian agencies to remediate it under **BOD 26-04**, while Langflow addressed the issue in its **`release-1.10.1`** branch by replacing `exec()`-based validation with compile-only validation and adding regression tests. Separately, a **Metasploit** exploit module for the bug is under active development in the Rapid7 framework, increasing the likelihood of broader weaponization. Organizations with internet-facing Langflow deployments are being urged to patch immediately and investigate exposed systems as potentially compromised even after remediation.
Aug 4, 2026