Disabling Pickle Did Not Remove Pickle: SGLang internal decoder test

Evidence record

Read the original source ↗

Claim-level citations (5)

• supportsSGLang internal MessagePack still reached an unsafe Pickle decoder: A researcher reported command execution in a SGLang 0.5.18 two-GPU service when an internal ZeroMQ receiver was reachable remotely, both with direct Pickle IPC enabled and disabled.

  Introduction and "From a code path to a running service" section.

• supportsSGLang internal MessagePack still reached an unsafe Pickle decoder: The MessagePack receiver accepted PickleWrapper objects that were subsequently passed to pickle.loads, leaving a deserialization path after SGLANG_USE_PICKLE_IPC was set to false.

  Section "The switch changed the envelope".

• supportsSGLang internal MessagePack still reached an unsafe Pickle decoder: The reported remote test used data-parallel attention, a non-loopback distribution address and a reachable internal receiver. The ordinary HTTP API remained on loopback; the study does not demonstrate delivery through that API or default remote exposure.

  When an internal receiver becomes reachable; From a code path to a running service.

• supportsSGLang internal MessagePack still reached an unsafe Pickle decoder: The researcher reports three fresh starts per receive mode. Every crafted message produced one matching-PID marker; the receiver then exited. Connect-only controls were transcript-recorded, and the first default-mode baseline and listener identity were available only in that transcript.

  What six fresh starts established; Figure 3 and Scope of the experiment.

• supportsSGLang internal MessagePack still reached an unsafe Pickle decoder: The post distinguishes runtime tests of 0.5.18 from October 1 source inspection of 0.5.20 and a pinned main revision. It notes that 0.5.21 existed on October 7 but was not assessed, so those checks do not establish a continuous affected range or the newer release's fix status.

  Coordination and source status, paragraphs 2-3.