CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2026-5760

SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().

CVSS Score
9.8
Critical
EPSS — Exploit Probability
0.9%
Riskier than 54% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
NVD entry PoC / advisory

1 article across 1 outlet · first covered Apr 20, 2026 · latest Apr 20, 2026

Coverage timeline