Turning off direct Pickle transport did not remove an executable deserialization path in the SGLang configuration tested by researcher m00dy. The reported 0.5.18 experiment reached a launcher-created internal receiver from a second host and produced a harmless local marker in its process, with direct Pickle IPC both enabled and disabled. The disabled…
Inspect the ClaimsCase · DiggingBeagle record
SGLang internal MessagePack still reached an unsafe Pickle decoder
A researcher reported command execution in a SGLang 0.5.18 two-GPU service when an internal ZeroMQ receiver was reachable remotely, both with direct Pickle IPC enabled and disabled.
Scope
Controlled reproduction of CVE-2026-93034 in SGLang 0.5.18, publicly disclosed October 7-8, 2026.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- AI role
- AGAINST AI
Basis and provenance
A researcher reports six fresh-service trials on stock 0.5.18, three per receive mode, with a marker tied to the receiver PID. The non-default network prerequisite and transcript-only portions of the evidence limit the result; newer releases were not runtime-tested here. Primary passages were inspected in this review, but the pinned contract supplies no grading rubric for A-D or the numeric impact bands; both remain ungraded. This is a source review, not an independent reproduction.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R4-SGLANG-PICKLE-1 · CLM-R4-SGLANG-PICKLE-2 · CLM-R4-SGLANG-PICKLE-3 · CLM-R4-SGLANG-PICKLE-4 · CLM-R4-SGLANG-PICKLE-5 · Disabling Pickle Did Not Remove Pickle: SGLang internal decoder test
At a glance
Changing an outer IPC format is insufficient if a compatibility wrapper can still invoke an unsafe decoder on data from a reachable peer.
Read the implicationsCurrent downstream deployment exposure and in-the-wild exploitation are not established. The source explicitly leaves 0.5.21 unassessed; no newer release was independently validated in this review. The described connection-only control is not a matched benign-message comparison, and the first default trial has transcript-only baseline and identity records.
Limits and uncertaintyFull account
Turning off direct Pickle transport did not remove an executable deserialization path in the SGLang configuration tested by researcher m00dy. The reported 0.5.18 experiment reached a launcher-created internal receiver from a second host and produced a harmless local marker in its process, with direct Pickle IPC both enabled and disabled.
The disabled setting selected a MessagePack envelope. Inside that path, a PickleWrapper compatibility object could still reach pickle.loads before the relevant message validation. The format change therefore left executable object reconstruction available to a sender who could reach the receiver. It did not make every MessagePack message unsafe, nor did it demonstrate attack delivery through SGLang's ordinary HTTP API.
Reachability was an explicit prerequisite. The test used data-parallel attention and a non-loopback distribution address, while HTTP remained bound to loopback. Across three fresh starts per receive mode, the researcher reports one marker with a matching process ID after each crafted message; the receiver then exited. These six controlled starts support execution in that receiver, without establishing persistent access. Connection-only controls were recorded in a transcript, and the first default-mode baseline and listener identity were available only there. No matched benign-message comparison was reported.
Version evidence must remain separated by method. Runtime tests concern 0.5.18. October 1 source inspection found the receive and unwrap primitives in 0.5.20 and a pinned main revision, but the author explicitly left 0.5.21 unassessed. Those observations do not establish a continuous affected range or the current fix status of newer releases. Limiting receiver reachability changes who can supply the message; a data-only decoder would address executable reconstruction itself. The source proposes the latter design without demonstrating a shipped, verified repair.
Mechanism and trust boundary
- 01
Reachable internal receiver
The demonstrated cross-host route required data-parallel attention, a non-loopback distribution address and network access to the receiver port.
Boundary: A loopback inference API does not establish isolation of separately bound internal IPC.
- 02
Executable reconstruction
Both raw Pickle and a MessagePack PickleWrapper reached object reconstruction before dispatch validation.
Boundary: An outer type check can accept a wrapper whose decoder executes a sender-selected action.
- 03
Marker before rejection
The researcher reports a process-ID marker written by the launched receiver before the reconstructed value was rejected and the receiver exited.
Boundary: A later invalid-message error does not prove there were no earlier side effects.
Timeline
- Oct 7, 2026disclosure
Public disclosure
Claims & evidence
CLM-R4-SGLANG-PICKLE-1A researcher reported command execution in a SGLang 0.5.18 two-GPU service when an internal ZeroMQ receiver was reachable remotely, both with direct Pickle IPC enabled and disabled.supported
Basis: reported finding
- supportsDisabling Pickle Did Not Remove Pickle: SGLang internal decoder testprimary disclosure
Introduction and "From a code path to a running service" section.
CLM-R4-SGLANG-PICKLE-2The MessagePack receiver accepted PickleWrapper objects that were subsequently passed to pickle.loads, leaving a deserialization path after SGLANG_USE_PICKLE_IPC was set to false.supported
Basis: reported finding
- supportsDisabling Pickle Did Not Remove Pickle: SGLang internal decoder testprimary disclosure
Section "The switch changed the envelope".
CLM-R4-SGLANG-PICKLE-3The reported remote test used data-parallel attention, a non-loopback distribution address and a reachable internal receiver. The ordinary HTTP API remained on loopback; the study does not demonstrate delivery through that API or default remote exposure.supported
Basis: reported finding
- supportsDisabling Pickle Did Not Remove Pickle: SGLang internal decoder testprimary disclosure
When an internal receiver becomes reachable; From a code path to a running service.
CLM-R4-SGLANG-PICKLE-4The researcher reports three fresh starts per receive mode. Every crafted message produced one matching-PID marker; the receiver then exited. Connect-only controls were transcript-recorded, and the first default-mode baseline and listener identity were available only in that transcript.supported
Basis: reported finding
- supportsDisabling Pickle Did Not Remove Pickle: SGLang internal decoder testprimary disclosure
What six fresh starts established; Figure 3 and Scope of the experiment.
CLM-R4-SGLANG-PICKLE-5The post distinguishes runtime tests of 0.5.18 from October 1 source inspection of 0.5.20 and a pinned main revision. It notes that 0.5.21 existed on October 7 but was not assessed, so those checks do not establish a continuous affected range or the newer release's fix status.supported
Basis: reported finding
- supportsDisabling Pickle Did Not Remove Pickle: SGLang internal decoder testprimary disclosure
Coordination and source status, paragraphs 2-3.
Implications
Changing an outer IPC format is insufficient if a compatibility wrapper can still invoke an unsafe decoder on data from a reachable peer.
Controls and mitigations
- Limit internal-receiver reachability where cross-host traffic is unnecessary. This changes who can send a payload, while a data-only decoder would remove executable reconstruction. The source proposes the latter design; it does not demonstrate a shipped and verified repair.
Unknowns and contradictions
- Current downstream deployment exposure and in-the-wild exploitation are not established.
- The source explicitly leaves 0.5.21 unassessed; no newer release was independently validated in this review.
- The described connection-only control is not a matched benign-message comparison, and the first default trial has transcript-only baseline and identity records.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 141