SGL Project SGLang HuggingFace Transformer Handler Remote Deserialization Vulnerability

A remote deserialization vulnerability has been identified in SGL Project SGLang versions through 0.5.9. The issue arises in the HuggingFace Transformer Handler, specifically within the get_tokenizer function of the file python/sglang/srt/utils/hf_transformers_utils.py. This vulnerability allows for manipulation that could be exploited, although it is considered to have a high complexity level, making exploitation difficult.

Impact

Exploitation of this vulnerability leads to unauthorized deserialization, which could potentially be used to execute arbitrary code or manipulate application behavior.