CVE-2026-7669 — Sgl-Project SGLang Insecure Deserialization

title: CVE-2026-7669 - SGLang Insecure Deserialization via HuggingFace Handler
id: scw-2026-05-02-ai-1
status: experimental
level: high
description: |
  Detects the execution of the vulnerable function 'get_tokenizer' within the SGLang library, specifically when called via Python. This indicates a potential attempt to exploit the insecure deserialization vulnerability (CVE-2026-7669) in the HuggingFace Transformer Handler component.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7669/
tags:
  - attack.execution
  - attack.t1204.002
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'python.exe'
      CommandLine|contains:
          - 'sglang.srt.utils.hf_transformers_utils.get_tokenizer'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse