get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation results in deserialization.This vulnerability is identified as CVE-2026-7669. The attack can be executed remotely. There is not any exploit available.
The vendor was contacted early about this disclosure but did not respond in any way.
SOCIAL SHARE CARD GENERATOR