{"vulnerability": "CVE-2026-5760", "sightings": [{"uuid": "efdb6e67-f65f-4cd4-ad37-79cd8561cd3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/39752", "content": "SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files \u2013 thehackernews.com\n\nTue, 21 Apr 2026 01:14:00", "creation_timestamp": "2026-04-20T20:04:13.000000Z"}, {"uuid": "bdc85573-f1be-4813-9191-81100d2b2d5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "published-proof-of-concept", "source": "https://t.me/TengkorakCyberCrewzz/9848", "content": "SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files \u2013 thehackernews.com\n\nTue, 21 Apr 2026 01:14:00", "creation_timestamp": "2026-04-20T20:04:13.000000Z"}, {"uuid": "1c2e45b9-d365-4cdc-810e-a86239dd5364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/8834", "content": "\u26a0\ufe0f SGLang has a critical flaw enabling remote code execution (CVSS 9.8) via malicious GGUF model files.\n\nA crafted Jinja2 template runs when /v1/rerank is triggered, executing attacker code on the server.\n\n\ud83d\udd17 How GGUF templates become an RCE path \u2192 https://thehackernews.com/2026/04/sglang-cve-2026-5760-cvss-98-enables.html", "creation_timestamp": "2026-04-20T17:20:02.000000Z"}, {"uuid": "1acc029b-7101-4576-8b62-01a66529ba61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://t.me/ctinow/249056", "content": "SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files\nhttps://ift.tt/Hw4Xdgr", "creation_timestamp": "2026-04-20T18:44:42.000000Z"}, {"uuid": "5a0a4d70-7670-4543-8a65-95e4de551561", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://t.me/cibsecurity/89064", "content": "\ud83d\udd8b\ufe0f SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files \ud83d\udd8b\ufe0f\n\nA critical security vulnerability has been disclosed in SGLang that, if successfully exploited, could result in remote code execution on susceptible systems. The vulnerability, tracked as CVE20265760, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of command injection leading to the execution of arbitrary code. SGLang is a highperformance, opensource serving.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "creation_timestamp": "2026-04-20T22:27:37.000000Z"}, {"uuid": "4c88703d-6ed8-4aa2-9bcc-4a46c37c92d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjwt3o4mq52n", "content": "", "creation_timestamp": "2026-04-20T15:50:50.531853Z"}, {"uuid": "cddef8e6-9166-4378-bf9f-05de4a74f040", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjx5dx2ppf2u", "content": "", "creation_timestamp": "2026-04-20T18:54:26.482195Z"}, {"uuid": "13862167-d71a-42a5-87e3-39a4f3e675b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://thehackernews.com/2026/04/sglang-cve-2026-5760-cvss-98-enables.html", "content": "", "creation_timestamp": "2026-04-20T15:14:00.000000Z"}, {"uuid": "26293eda-f0d3-43d9-a02d-3d8445f96db3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mjxcfsxopd26", "content": "", "creation_timestamp": "2026-04-20T20:24:58.520465Z"}, {"uuid": "8b9fb15f-e246-4b35-a396-12111b716480", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mjxffrc54l2k", "content": "", "creation_timestamp": "2026-04-20T21:18:37.579722Z"}, {"uuid": "757be786-a38d-451a-8cd6-bee59007cbf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mjxgmmlyqh2a", "content": "", "creation_timestamp": "2026-04-20T21:40:21.138389Z"}, {"uuid": "4006285e-334d-4f5b-9694-6363a2133351", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mjxri75wo52q", "content": "", "creation_timestamp": "2026-04-21T00:54:52.680222Z"}, {"uuid": "cdb09943-7ae7-44d4-a7ab-1324b62e5b33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/LLMs.activitypub.awakari.com.ap.brid.gy/post/3mjxsqbtovkw2", "content": "", "creation_timestamp": "2026-04-21T01:17:12.542892Z"}, {"uuid": "9678e11b-ab90-4d4b-baab-93a98cd0c31f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mjy4p2t7ya2s", "content": "", "creation_timestamp": "2026-04-21T04:15:25.643226Z"}, {"uuid": "ae875604-377e-4167-949f-97db836f1e7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/akoaxan.iamveryti.red.ap.brid.gy/post/3mjysmm2kysx2", "content": "", "creation_timestamp": "2026-04-21T10:47:48.821083Z"}, {"uuid": "375f7fb1-efb2-4a7d-bc4e-204cc6e3ecd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mk26sce5ay2t", "content": "", "creation_timestamp": "2026-04-21T23:58:20.978246Z"}, {"uuid": "05dda17e-50fd-48f0-9913-dd035ab7740a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5760", "type": "published-proof-of-concept", "source": "https://github.com/Stuub/SGLang-0.5.9-RCE", "content": "", "creation_timestamp": "2026-04-02T04:00:00.000000Z"}, {"uuid": "72a76c82-d741-4f82-b249-8f18d3c3a8aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3mk3px7gnbc2u", "content": "", "creation_timestamp": "2026-04-22T14:38:04.228180Z"}, {"uuid": "54678fef-4375-4e30-b9b6-a5fe66d05c1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3mk445qhs4c2d", "content": "", "creation_timestamp": "2026-04-22T18:16:27.430260Z"}, {"uuid": "8881dd73-2109-4514-a4ee-364b67f0f7a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mk4no57mph2c", "content": "", "creation_timestamp": "2026-04-22T23:29:46.269756Z"}, {"uuid": "3513316e-b716-4535-8b3f-2570052a7ad7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3mk5rphiics24", "content": "", "creation_timestamp": "2026-04-23T10:14:49.526674Z"}, {"uuid": "04601ad8-df23-4b4d-b0cb-afd7fdcc2a92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkevw7ecak2s", "content": "", "creation_timestamp": "2026-04-26T06:18:47.870964Z"}, {"uuid": "95097154-4a65-4b77-ab18-19eb9c5361c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "published-proof-of-concept", "source": "Telegram/7uvNKIkKUjmk2sMVfR5LVifrbyQORs8bQP9lip1EoQrHag", "content": "", "creation_timestamp": "2026-04-21T02:13:45.000000Z"}, {"uuid": "d951a7d1-365a-4fae-8895-e8a7f25c7f58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "published-proof-of-concept", "source": "Telegram/U2O1eQ5mSIep6JMLEua9jzcZY1kR08e_uIgBvSnnSFh4ng", "content": "", "creation_timestamp": "2026-04-21T00:44:02.000000Z"}, {"uuid": "3c8f2985-584d-42cc-9c2d-e4150abbfe00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "Telegram/hFxIO41xlFzh2jQkUD7ke9A61oBvDNutGhkEmwpRW_mhNxw", "content": "", "creation_timestamp": "2026-04-20T17:21:32.000000Z"}, {"uuid": "b27d32ba-e086-473f-a19e-3efd0a16a1f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3mlcjmcdaik2j", "content": "\u26a0\ufe0f Manual T\u00e9cnico: Reparaci\u00f3n del CVE-2026-5760 en el Framework de IA SGLang www.newstecnicas.com/2026/04/manu...", "creation_timestamp": "2026-05-08T00:58:28.409937Z"}, {"uuid": "798b1738-d2d8-4813-a036-c70a2e29b424", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mmidr6bd3227", "content": "\u26a0\ufe0f Manual T\u00e9cnico: Reparaci\u00f3n del CVE-2026-5760 en el Framework de IA #SGLang www.newstecnicas.com/2026/04/manu...", "creation_timestamp": "2026-05-23T01:54:53.638371Z"}, {"uuid": "39e93644-e737-4750-88ac-a919db5f1bd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://t.me/VulnerabilityNews/42061", "content": "SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files\n\nA critical security vulnerability has been disclosed in SGLang that, if successfully exploited, could result in remote code execution on susceptible systems.\nThe vulnerability, tracked as CVE-2026-5760, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of command injection leading to the execution of arbitrary code.\nSGLang is a high-performance, open-source serving\nhttps://thehackernews.com/2026/04/sglang-cve-2026-5760-cvss-98-enables.html", "creation_timestamp": "2026-08-18T19:00:04.707987Z"}, {"uuid": "6683398b-b939-483c-9e5a-5aee9a3deecb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "published-proof-of-concept", "source": "https://t.me/VulnerabilityNews/42061", "content": "SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files\n\nA critical security vulnerability has been disclosed in SGLang that, if successfully exploited, could result in remote code execution on susceptible systems.\nThe vulnerability, tracked as CVE-2026-5760, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of command injection leading to the execution of arbitrary code.\nSGLang is a high-performance, open-source serving\nhttps://thehackernews.com/2026/04/sglang-cve-2026-5760-cvss-98-enables.html", "creation_timestamp": "2026-08-19T00:00:09.232183Z"}, {"uuid": "30a59e66-38c7-4ea3-880a-eabc080adc43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/21018", "content": "SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files \u2013 thehackernews.com\n\nTue, 21 Apr 2026 01:14:00", "creation_timestamp": "2026-07-19T16:00:05.644211Z"}, {"uuid": "f936a670-b23c-4023-a8cb-206544b8b05a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://t.me/critical_bug/1739", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 CVE-2026-5760 \u0432 PDF", "creation_timestamp": "2026-07-19T16:00:09.575547Z"}, {"uuid": "aab8bfb3-0b1f-4391-acd8-02c5222d3ca8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://t.me/critical_bug/1741", "content": "\ud83d\udc31 hacker voice I AM IN YOUR AI MODEL \ud83d\udd34\n\n\ud83d\udd25 CVE-2026-5760: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u0432 AI-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 SGLang\n\nCVSS: 9.8 Critical | \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 GGUF-\u043c\u043e\u0434\u0435\u043b\u044c\n\n\u0412 SGLang (\u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 LLM) \u043d\u0430\u0448\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0434\u0441\u0443\u043d\u0443\u0432 \u0435\u043c\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043c\u043e\u0434\u0435\u043b\u044c. \ud83d\ude2c\n\n\ud83d\udca5 \u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430:\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0435 /v1/rerank. \u0415\u0441\u043b\u0438 \u0441\u043a\u043e\u0440\u043c\u0438\u0442\u044c \u0435\u043c\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 GGUF-\u0444\u0430\u0439\u043b \u043c\u043e\u0434\u0435\u043b\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 tokenizer.chat_template \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 Jinja2 SSTI (Server-Side Template Injection) \u043f\u0435\u0439\u043b\u043e\u0430\u0434, \u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 Python-\u043a\u043e\u0434. \u0412\u0441\u0451 \u0438\u0437-\u0437\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f jinja2.Environment() \u0431\u0435\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b.\n\n\ud83d\udea8 \u0427\u0435\u043c \u044d\u0442\u043e \u043e\u043f\u0430\u0441\u043d\u043e?\n\u2014 \u041f\u043e\u043b\u043d\u044b\u0439 \u0437\u0430\u0445\u0432\u0430\u0442 AI-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\n\u2014 \u041a\u0440\u0430\u0436\u0430 \u0434\u0430\u0442\u0430\u0441\u0435\u0442\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439\n\u2014 \u0414\u043e\u0441\u0442\u0443\u043f \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 (lateral movement)\n\u2014 \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d\u044b \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441?\n1\ufe0f\u20e3 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c ImmutableSandboxedEnvironment \u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e jinja2.Environment() \u0434\u043b\u044f \u0440\u0435\u043d\u0434\u0435\u0440\u0438\u043d\u0433\u0430 \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432.\n2\ufe0f\u20e3 \u041d\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c GGUF-\u043c\u043e\u0434\u0435\u043b\u0438 \u0438\u0437 \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432.\n3\ufe0f\u20e3 \u0418\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c AI-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u0445 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u043e\u0432 \u0441\u0435\u0442\u0438.\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u2014 \u0432 PDF \u043d\u0438\u0436\u0435 \ud83d\udc47\n\n\ud83d\udc8e \u0411\u043e\u043b\u044c\u0448\u0435 \u044d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u043e\u0432 \u0438 0-day \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445: VIP-\u0432\u0435\u0440\u0441\u0438\u044f \u043a\u0430\u043d\u0430\u043b\u0430\n\n#SGLang #CVE #RCE #AI #LLM #CyberSecurity #Infosec #criticalbug", "creation_timestamp": "2026-07-19T16:00:09.613439Z"}, {"uuid": "c9742925-aa3e-40d6-a00b-2b4e8b0b530e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/21018", "content": "SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files \u2013 thehackernews.com\n\nTue, 21 Apr 2026 01:14:00", "creation_timestamp": "2026-07-20T00:00:21.668669Z"}, {"uuid": "9b611ac1-0ea6-4ace-ad48-23544a669db6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1741", "content": "\ud83d\udc31 hacker voice I AM IN YOUR AI MODEL \ud83d\udd34\n\n\ud83d\udd25 CVE-2026-5760: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u0432 AI-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 SGLang\n\nCVSS: 9.8 Critical | \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 GGUF-\u043c\u043e\u0434\u0435\u043b\u044c\n\n\u0412 SGLang (\u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 LLM) \u043d\u0430\u0448\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0434\u0441\u0443\u043d\u0443\u0432 \u0435\u043c\u0443 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043c\u043e\u0434\u0435\u043b\u044c. \ud83d\ude2c\n\n\ud83d\udca5 \u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430:\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0435 /v1/rerank. \u0415\u0441\u043b\u0438 \u0441\u043a\u043e\u0440\u043c\u0438\u0442\u044c \u0435\u043c\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 GGUF-\u0444\u0430\u0439\u043b \u043c\u043e\u0434\u0435\u043b\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 tokenizer.chat_template \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 Jinja2 SSTI (Server-Side Template Injection) \u043f\u0435\u0439\u043b\u043e\u0430\u0434, \u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 Python-\u043a\u043e\u0434. \u0412\u0441\u0451 \u0438\u0437-\u0437\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f jinja2.Environment() \u0431\u0435\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b.\n\n\ud83d\udea8 \u0427\u0435\u043c \u044d\u0442\u043e \u043e\u043f\u0430\u0441\u043d\u043e?\n\u2014 \u041f\u043e\u043b\u043d\u044b\u0439 \u0437\u0430\u0445\u0432\u0430\u0442 AI-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\n\u2014 \u041a\u0440\u0430\u0436\u0430 \u0434\u0430\u0442\u0430\u0441\u0435\u0442\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439\n\u2014 \u0414\u043e\u0441\u0442\u0443\u043f \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 (lateral movement)\n\u2014 \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d\u044b \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441?\n1\ufe0f\u20e3 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c ImmutableSandboxedEnvironment \u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e jinja2.Environment() \u0434\u043b\u044f \u0440\u0435\u043d\u0434\u0435\u0440\u0438\u043d\u0433\u0430 \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432.\n2\ufe0f\u20e3 \u041d\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c GGUF-\u043c\u043e\u0434\u0435\u043b\u0438 \u0438\u0437 \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432.\n3\ufe0f\u20e3 \u0418\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c AI-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u0445 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u043e\u0432 \u0441\u0435\u0442\u0438.\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u2014 \u0432 PDF \u043d\u0438\u0436\u0435 \ud83d\udc47\n\n\ud83d\udc8e \u0411\u043e\u043b\u044c\u0448\u0435 \u044d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u043e\u0432 \u0438 0-day \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445: VIP-\u0432\u0435\u0440\u0441\u0438\u044f \u043a\u0430\u043d\u0430\u043b\u0430\n\n#SGLang #CVE #RCE #AI #LLM #CyberSecurity #Infosec #criticalbug", "creation_timestamp": "2026-07-20T00:00:08.003091Z"}, {"uuid": "38c6ff92-dae9-404b-82e3-acb7e910b201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5760", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1739", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 CVE-2026-5760 \u0432 PDF", "creation_timestamp": "2026-07-20T01:00:05.599290Z"}]}