Not scored
CVE-2026-3989
No description published yet
Vendor not yet named
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 8 Oct
0.4%probability of exploitation in the next 30 days
Higher than 35% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.
Coverage 1 article · 1 outlet
- AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCEThe Hacker News · first in our coverage · mentions it in passing