{"data":{"id":"3aeffdb0-94a0-4a54-8016-8690f8544fd0","title":"CVE-2026-7669: A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file…","summary":"CVE-2026-7669 affects sgl-project SGLang up to 0.5.9, specifically the function get_tokenizer in python/sglang/srt/utils/hf_transformers_utils.py within the HuggingFace Transformer Handler component. The flaw is a deserialization of untrusted data (CWE-502) that can be exploited remotely, with high attack complexity and difficult exploitability. The vendor did not respond to early disclosure, and the CVSS 4.0 base score is 6.3 (MEDIUM) per VulDB, with NVD assessment not yet provided.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7669","publishedAt":"2026-05-02T22:16:24.080Z","cveId":"CVE-2026-7669","cweIds":["CWE-20","CWE-502"],"cvssScore":"5.6","cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["sglang@<= 0.5.9"],"affectedPackageNames":["sglang"],"affectedPackageRefs":["pypi:sglang"],"affectedVendors":[],"affectedVendorsRaw":["SGLang"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"SGLang deserialization of untrusted data in get_tokenizer","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00368,"epssCheckedAt":"2026-11-09T12:10:44.972Z","kevDateAdded":null,"advisoryAliases":["GHSA-6m5f-673f-5vh7"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:58.056Z","patchAvailable":null,"disclosureDate":"2026-05-02T22:16:24.080Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}