CVE-2026-93088

Name of the Vulnerable Software and Affected Versions SGLang (affected versions not specified)

Description The multimodal generation runtime contains a flaw allowing unauthenticated arbitrary code execution. The issue occurs because the DiffusionServer within the disaggregated-diffusion orchestrator binds an unauthenticated ZeroMQ ROUTER socket to a network interface. The system then passes the final frame of received multipart messages directly to the pickle.loads() function without prior validation. Pickle is a Python module used for serializing and deserializing objects, and loading untrusted data through it can lead to the execution of malicious code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.