{"record":{"id":"59ee98ab4f6d2ec7","repo":"sgl-project/sglang","slug":"blocked-unsafe-class-loading-module-name-to","errorCode":null,"errorMessage":"Blocked unsafe class loading ({module}.{name}), to prevent exploitation of CVE-2025-10164","messagePattern":"Blocked unsafe class loading \\((.+?)\\.(.+?)\\), to prevent exploitation of CVE-2025-10164","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/utils/common.py","lineNumber":3019,"sourceCode":"        \"torch_npu.\",\n    }\n\n    DENY_CLASSES = {\n        (\"builtins\", \"eval\"),\n        (\"builtins\", \"exec\"),\n        (\"builtins\", \"compile\"),\n        (\"os\", \"system\"),\n        (\"subprocess\", \"Popen\"),\n        (\"subprocess\", \"run\"),\n        (\"codecs\", \"decode\"),\n        (\"types\", \"CodeType\"),\n        (\"types\", \"FunctionType\"),\n    }\n\n    def find_class(self, module, name):\n        # Block deterministic attacks\n        if (module, name) in self.DENY_CLASSES:\n            raise RuntimeError(\n                f\"Blocked unsafe class loading ({module}.{name}), \"\n                f\"to prevent exploitation of CVE-2025-10164\"\n            )\n        # Allowlist of safe-to-load modules.\n        if any(\n            (module + \".\").startswith(prefix) for prefix in self.ALLOWED_MODULE_PREFIXES\n        ):\n            return super().find_class(module, name)\n\n        # Block everything else. (Potential attack surface)\n        raise RuntimeError(\n            f\"Blocked unsafe class loading ({module}.{name}), \"\n            f\"to prevent exploitation of CVE-2025-10164\"\n        )\n\n\ndef safe_pickle_load(fp):\n    \"\"\"Drop-in replacement for pickle.load() that blocks unsafe class loading.\"\"\"","sourceCodeStart":3001,"sourceCodeEnd":3037,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/utils/common.py#L3001-L3037","documentation":"A restricted Unpickler blocks loading a class in its DENY_CLASSES set (e.g. types.FunctionType) to prevent CVE-2025-10164-style pickle code execution. Any pickle referencing a deny-listed globals entry is rejected before instantiation.","triggerScenarios":"safe_pickle_load (or a pickle-restricted API) on a payload pickled with a function object or other deny-listed global in globals.","commonSituations":"Loading pickles produced by older/other tooling that embedded lambdas or functions; untrusted pickle input.","solutions":["Re-produce the pickle containing only allowlisted data types (dicts, tensors, primitives)","If you control the format, use JSON/safetensors instead of pickle for interchange","Never bypass the deny list on untrusted input; it is a security boundary"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    obj = safe_pickle_load(fp)\nexcept RuntimeError as e:\n    if \"CVE-2025-10164\" in str(e):\n        reject_untrusted_payload()","preventionTips":["Only load pickles you produced with allowlisted types","Prefer safetensors/JSON for interchange","Treat deny-list hits as attacks, not bugs"],"tags":["security","pickle","cve","deserialization"],"backgroundTag":"unsafe-deserialization-blocked","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}