sgl-project/sglang · error · RuntimeError

Blocked unsafe class loading ({module}.{name}), to prevent e

Error message

Blocked unsafe class loading ({module}.{name}), to prevent exploitation of CVE-2025-10164

What it means

A restricted Unpickler blocks loading a class in its DENY_CLASSES set (e.g. types.FunctionType) to prevent CVE-2025-10164-style pickle code execution. Any pickle referencing a deny-listed globals entry is rejected before instantiation.

Source

Thrown at python/sglang/srt/utils/common.py:3019

        "torch_npu.",
    }

    DENY_CLASSES = {
        ("builtins", "eval"),
        ("builtins", "exec"),
        ("builtins", "compile"),
        ("os", "system"),
        ("subprocess", "Popen"),
        ("subprocess", "run"),
        ("codecs", "decode"),
        ("types", "CodeType"),
        ("types", "FunctionType"),
    }

    def find_class(self, module, name):
        # Block deterministic attacks
        if (module, name) in self.DENY_CLASSES:
            raise RuntimeError(
                f"Blocked unsafe class loading ({module}.{name}), "
                f"to prevent exploitation of CVE-2025-10164"
            )
        # Allowlist of safe-to-load modules.
        if any(
            (module + ".").startswith(prefix) for prefix in self.ALLOWED_MODULE_PREFIXES
        ):
            return super().find_class(module, name)

        # Block everything else. (Potential attack surface)
        raise RuntimeError(
            f"Blocked unsafe class loading ({module}.{name}), "
            f"to prevent exploitation of CVE-2025-10164"
        )


def safe_pickle_load(fp):
    """Drop-in replacement for pickle.load() that blocks unsafe class loading."""

View on GitHub (pinned to 0132848349)

Solutions

1. Re-produce the pickle containing only allowlisted data types (dicts, tensors, primitives)
2. If you control the format, use JSON/safetensors instead of pickle for interchange
3. Never bypass the deny list on untrusted input; it is a security boundary

try:
    obj = safe_pickle_load(fp)
except RuntimeError as e:
    if "CVE-2025-10164" in str(e):
        reject_untrusted_payload()

When it happens

Trigger: safe_pickle_load (or a pickle-restricted API) on a payload pickled with a function object or other deny-listed global in globals.

Common situations: Loading pickles produced by older/other tooling that embedded lambdas or functions; untrusted pickle input.

Related errors

• --grpc-port is incompatible with --api-key/--admin-api-key:
• allowed media domains must be strings
• allowed media domains cannot be empty
• Invalid allowed media domain {domain!r}: provide a hostname
• Invalid allowed media domain {domain!r}: ports are not suppo

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/59ee98ab4f6d2ec7. Report an issue: GitHub.