SGLang debug dumper executes caller-controlled Python inside its inference scheduler

SGLang's debugging dumper accepted a filter expression from the HTTP control route and evaluated it in the scheduler process. The code removed __builtins__ from the immediate evaluation globals, but supplied callable regex functions as allowed helpers. Python function objects expose their defining module globals. In the reported reproduction, the untrusted expression used that path to reach imports and run arbitrary Python; the test wrote a marker file from inside the scheduler.

The exploit depends on deployment configuration, not every ordinary inference request. The issue documents DUMPER_SERVER_PORT=reuse, a reachable /dumper/configure endpoint, subsequent model execution, and absence of a separately enforced admin credential, or possession of it. An ordinary model API key was sufficient in the controlled setup, while unauthenticated access would depend on the server's API configuration. The report includes a proposed AST-restricted evaluator, but a pull-request discussion is not proof that every deployed version is fixed.

The observed effect is controlled scheduler-code execution. It can imply access to files and credentials available to that process, but no live victim, stolen production secret or downstream campaign is confirmed.