CVE-2026-3989 CVE-2026-3989
An attacker can execute arbitrary code on the host by providing a malicious pickle file to the SGLang replay_request_dump.py script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-3989?
CVE-2026-3989 is a high-severity unsafe deserialization vulnerability in SGLang, published on 12 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.
Weakness: CWE-502
Which versions are affected by CVE-2026-3989?
3 open source packages ship an affected version, including sglang. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sglang PyPI | All versions | 0.5.10 |
sglang PyPI | All versions | 0.5.10 |
sglang PyPI | All versions | 0.5.10 |
Products include Lmsys Sglang.
How do I fix CVE-2026-3989?
Upgrade sglang to 0.5.10 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-3989 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3989 exists.
Other vulnerabilities in SGLang
Sources
Also known as GHSA-hvwj-8w5g-28rg, PYSEC-2026-3063.