CVE-2026-3989

High · 7.8

CVSS

7.8

EPSS

0.5%

Published

Mar 12, 2026

CISA due date

—

The record

SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.

Affected packages

Ecosystem	Package	Introduced	Fixed