{"id":749,"date":"2026-04-21T23:51:24","date_gmt":"2026-04-21T16:51:24","guid":{"rendered":"https:\/\/vncybers.vn\/lo-hong-cvss-9-8-trong-sglang-file-mo-hinh-ai-co-the-bien-thanh-vu-khi-tan-cong-may-chu\/"},"modified":"2026-04-23T21:26:48","modified_gmt":"2026-04-23T14:26:48","slug":"lo-hong-cvss-9-8-trong-sglang-file-mo-hinh-ai-co-the-bien-thanh-vu-khi-tan-cong-may-chu","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/lo-hong-cvss-9-8-trong-sglang-file-mo-hinh-ai-co-the-bien-thanh-vu-khi-tan-cong-may-chu\/","title":{"rendered":"L\u1ed7 h\u1ed5ng CVSS 9.8 trong SGLang: File m\u00f4 h\u00ecnh AI bi\u1ebfn th\u00e0nh v\u0169 kh\u00ed t\u1ea5n c\u00f4ng RCE"},"content":{"rendered":"
\"L\u1ed7<\/figure>\n\n\n\n

M\u1ed9t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt nghi\u00eam tr\u1ecdng v\u1eeba \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 trong SGLang<\/strong>, framework ph\u1ee5c v\u1ee5 AI inference ph\u1ed5 bi\u1ebfn, mang m\u00e3 CVE-2026-5760<\/strong> v\u1edbi \u0111i\u1ec3m CVSS \u0111\u1ea1t m\u1ee9c 9.8\/10 (Critical)<\/strong>. \u0110i\u1ec3m \u0111\u1eb7c bi\u1ec7t nguy hi\u1ec3m: k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n khai th\u00e1c l\u1ed7 h\u1ed5ng ph\u1ea7n m\u1ec1m truy\u1ec1n th\u1ed1ng. Ch\u00fang ch\u1ec9 c\u1ea7n nh\u00fang m\u00e3 \u0111\u1ed9c v\u00e0o file m\u00f4 h\u00ecnh AI<\/strong> r\u1ed3i ph\u00e1t t\u00e1n qua c\u00e1c n\u1ec1n t\u1ea3ng \u0111\u00e1ng tin nh\u01b0 Hugging Face.<\/p>\n\n\n\n

CVE-2026-5760 l\u00e0 g\u00ec?<\/h2>\n\n\n

\u0110\u00e2y l\u00e0 l\u1ed7 h\u1ed5ng command injection \u2192 Remote Code Execution (RCE)<\/strong> trong SGLang, xu\u1ea5t ph\u00e1t t\u1eeb vi\u1ec7c render template Jinja2 kh\u00f4ng an to\u00e0n t\u1ea1i endpoint \/v1\/rerank<\/strong>. V\u1ea5n \u0111\u1ec1 c\u1ed1t l\u00f5i: SGLang d\u00f9ng jinja2.Environment()<\/code> th\u00f4ng th\u01b0\u1eddng thay v\u00ec ImmutableSandboxedEnvironment()<\/code>, t\u1ee9c l\u00e0 kh\u00f4ng c\u00f3 sandbox, Python code trong template \u0111\u01b0\u1ee3c th\u1ef1c thi ho\u00e0n to\u00e0n t\u1ef1 do.<\/p>\n\n\n\n

Chu\u1ed7i t\u1ea5n c\u00f4ng t\u1eebng b\u01b0\u1edbc<\/h2>\n\n\n

K\u1ecbch b\u1ea3n khai th\u00e1c l\u1ed7 h\u1ed5ng n\u00e0y c\u1ef1c k\u1ef3 tinh vi:<\/p>\n\n\n\n

  1. K\u1ebb t\u1ea5n c\u00f4ng t\u1ea1o file GGUF ch\u1ee9a payload Jinja2 SSTI<\/strong> nh\u00fang trong tr\u01b0\u1eddng tokenizer.chat_template<\/code><\/li>
  2. File m\u00f4 h\u00ecnh \u0111\u01b0\u1ee3c upload l\u00ean Hugging Face ho\u1eb7c repository \u0111\u00e1ng tin<\/li>
  3. Nh\u00e0 ph\u00e1t tri\u1ec3n t\u1ea3i m\u00f4 h\u00ecnh v\u1ec1 v\u00e0 load v\u00e0o SGLang<\/li>
  4. Khi endpoint \/v1\/rerank<\/strong> \u0111\u01b0\u1ee3c g\u1ecdi, template \u0111\u1ed9c h\u1ea1i \u0111\u01b0\u1ee3c render<\/li>
  5. Payload th\u1ef1c thi Python code t\u00f9y \u00fd tr\u00ean m\u00e1y ch\u1ee7, kh\u00f4ng c\u1ea7n th\u00eam b\u1ea5t k\u1ef3 t\u01b0\u01a1ng t\u00e1c n\u00e0o<\/strong><\/li><\/ol>\n\n\n\n

    T\u1ea1i sao \u0111\u00e2y l\u00e0 m\u1ed1i \u0111e d\u1ecda th\u1ef1c s\u1ef1 \u0111\u00e1ng lo?<\/h2>\n\n\n

    \u0110i\u1ec3m khi\u1ebfn CVE-2026-5760 kh\u00e1c bi\u1ec7t v\u1edbi c\u00e1c l\u1ed7 h\u1ed5ng th\u00f4ng th\u01b0\u1eddng:<\/p>\n\n\n\n

    • \ud83d\udd34 Kh\u00f4ng c\u1ea7n exploit truy\u1ec1n th\u1ed1ng<\/strong>, file m\u00f4 h\u00ecnh h\u1ee3p l\u1ec7 l\u00e0 v\u0169 kh\u00ed<\/li>
    • \ud83d\udd34 L\u1ee3i d\u1ee5ng chu\u1ed7i cung \u1ee9ng AI<\/strong>, m\u00f4 h\u00ecnh ph\u00e1t t\u00e1n qua k\u00eanh \u0111\u00e1ng tin nh\u01b0 Hugging Face<\/li>
    • \ud83d\udd34 Chi\u1ebfm to\u00e0n b\u1ed9 m\u00e1y ch\u1ee7<\/strong>, th\u1ef1c thi Python code t\u00f9y \u00fd, leo thang \u0111\u1eb7c quy\u1ec1n, di chuy\u1ec3n ngang<\/li>
    • \ud83d\udd34 Kh\u00f3 ph\u00e1t hi\u1ec7n<\/strong>, payload \u1ea9n trong metadata m\u00f4 h\u00ecnh, kh\u00f4ng xu\u1ea5t hi\u1ec7n nh\u01b0 malware th\u00f4ng th\u01b0\u1eddng<\/li><\/ul>\n\n\n\n

      H\u1eadu qu\u1ea3 n\u1ebfu b\u1ecb khai th\u00e1c<\/h2>\n\n\n

      Khi m\u00e1y ch\u1ee7 AI inference b\u1ecb chi\u1ebfm quy\u1ec1n ki\u1ec3m so\u00e1t, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3:<\/p>\n\n\n\n

      • \u0110\u00e1nh c\u1eafp to\u00e0n b\u1ed9 d\u1eef li\u1ec7u \u0111ang x\u1eed l\u00fd tr\u00ean m\u00e1y ch\u1ee7<\/li>
      • \u0110\u1ea7u \u0111\u1ed9c m\u00f4 h\u00ecnh AI (model poisoning) \u0111\u1ec3 t\u1ea1o ra output sai l\u1ec7ch c\u00f3 ch\u1ee7 \u0111\u00edch<\/li>
      • C\u00e0i c\u1eafm malware duy tr\u00ec (persistent backdoor)<\/li>
      • Di chuy\u1ec3n sang c\u00e1c h\u1ec7 th\u1ed1ng kh\u00e1c trong c\u00f9ng h\u1ea1 t\u1ea7ng<\/li><\/ul>\n\n\n\n

        Xu h\u01b0\u1edbng nguy hi\u1ec3m: T\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng AI<\/h2>\n\n\n

        CVE-2026-5760 kh\u00f4ng ph\u1ea3i tr\u01b0\u1eddng h\u1ee3p \u0111\u01a1n l\u1ebb. \u0110\u00e2y l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a l\u00e0n s\u00f3ng t\u1ea5n c\u00f4ng nh\u1eafm v\u00e0o h\u1ea1 t\u1ea7ng AI \u0111ang n\u1ed5i l\u00ean m\u1ea1nh m\u1ebd:<\/p>\n\n\n\n

        • Llama Drama (CVE-2024-34359)<\/strong>, l\u1ed7 h\u1ed5ng t\u01b0\u01a1ng t\u1ef1 trong llama.cpp<\/li>
        • vLLM SSTI (CVE-2025-61620)<\/strong>, c\u00f9ng ki\u1ec3u t\u1ea5n c\u00f4ng template injection tr\u00ean framework vLLM<\/li><\/ul>\n\n\n\n

          H\u1ea1 t\u1ea7ng AI tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau h\u1ea5p d\u1eabn v\u00ec th\u01b0\u1eddng ch\u1ea1y v\u1edbi quy\u1ec1n cao<\/strong>, x\u1eed l\u00fd d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m<\/strong>, k\u1ebft n\u1ed1i v\u1edbi nhi\u1ec1u d\u1ecbch v\u1ee5 n\u1ed9i b\u1ed9 v\u00e0 th\u01b0\u1eddng xuy\u00ean t\u1ea3i m\u00f4 h\u00ecnh t\u1eeb ngu\u1ed3n b\u00ean ngo\u00e0i.<\/p>\n\n\n\n

          Bi\u1ec7n ph\u00e1p kh\u1eafc ph\u1ee5c ngay l\u1eadp t\u1ee9c<\/h2>\n\n\n
          1. Kh\u00f4ng load m\u00f4 h\u00ecnh t\u1eeb ngu\u1ed3n kh\u00f4ng tin c\u1eady<\/strong>, ki\u1ec3m tra k\u1ef9 publisher v\u00e0 l\u1ecbch s\u1eed commit tr\u00ean Hugging Face<\/li>
          2. C\u1eadp nh\u1eadt SGLang<\/strong> l\u00ean phi\u00ean b\u1ea3n \u0111\u00e3 v\u00e1 CVE-2026-5760 ngay khi c\u00f3<\/li>
          3. Ch\u1ea1y inference server trong container c\u00f4 l\u1eadp<\/strong> (Docker\/Kubernetes v\u1edbi policy gi\u1edbi h\u1ea1n)<\/li>
          4. Ch\u1eb7n outbound connection<\/strong> t\u1eeb m\u00e1y ch\u1ee7 inference, payload kh\u00f4ng th\u1ec3 call-back n\u1ebfu m\u1ea1ng b\u1ecb ch\u1eb7n<\/li>
          5. Gi\u00e1m s\u00e1t h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng<\/strong> tr\u00ean m\u00e1y ch\u1ee7 AI, \u0111\u1eb7c bi\u1ec7t c\u00e1c ti\u1ebfn tr\u00ecnh spawn t\u1eeb process inference<\/li><\/ol>\n\n\n\n

             <\/p>\n\n\n

            VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb: The Hacker News, Vulert, SOC Defenders, C\u1eadp nh\u1eadt ng\u00e0y 21\/4\/2026<\/em><\/p>","protected":false},"excerpt":{"rendered":"

            CVE-2026-5760 v\u1eeba \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 , l\u1ed7 h\u1ed5ng c\u1ef1c k\u1ef3 nguy hi\u1ec3m (CVSS 9.8) trong framework AI SGLang cho ph\u00e9p th\u1ef1c thi m\u00e3 t\u1eeb xa th\u00f4ng qua file m\u00f4 h\u00ecnh GGUF \u0111\u1ed9c h\u1ea1i. K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 ph\u00e1t t\u00e1n m\u00f4 h\u00ecnh nhi\u1ec5m m\u00e3 qua Hugging Face \u0111\u1ec3 chi\u1ebfm quy\u1ec1n ki\u1ec3m so\u00e1t to\u00e0n b\u1ed9 m\u00e1y ch\u1ee7 AI.<\/p>","protected":false},"author":2,"featured_media":748,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[21,35,34,40,36],"class_list":["post-749","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-ai","tag-cve","tag-lo-hong-bao-mat","tag-ma-nguon-mo","tag-rce"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/749","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=749"}],"version-history":[{"count":10,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/749\/revisions"}],"predecessor-version":[{"id":1085,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/749\/revisions\/1085"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/748"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=749"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=749"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=749"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}