From 1e14bd6f36b73d100588de698ac8c7ea7f53d50f Mon Sep 17 00:00:00 2001
From: ccullen-cert <145690209+ccullen-cert@users.noreply.github.com>
Date: Tue, 28 Apr 2026 22:39:44 -0400
Subject: [PATCH] Fix for CVE-2026-5760 (#23660)

---
 python/sglang/srt/entrypoints/openai/serving_rerank.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/python/sglang/srt/entrypoints/openai/serving_rerank.py b/python/sglang/srt/entrypoints/openai/serving_rerank.py
index 853d44da0..57f5af4ca 100644
--- a/python/sglang/srt/entrypoints/openai/serving_rerank.py
+++ b/python/sglang/srt/entrypoints/openai/serving_rerank.py
@@ -119,13 +119,14 @@ def _qwen3_rerank_score(p_yes: float, p_no: float) -> float:
 def _get_jinja_env():
     try:
         import jinja2  # Lazy import: server env should provide this dependency.
+        from jinja2.sandbox import ImmutableSandboxedEnvironment
     except ModuleNotFoundError as e:
         raise ValueError(
             "Rendering Qwen3 reranker prompts requires `jinja2`. "
             "Please install it in your runtime environment (e.g., `pip install jinja2`)."
         ) from e
-
-    return jinja2.Environment(
+    # Using a sandboxed environment to stop malicious execution during model loading.
+    return ImmutableSandboxedEnvironment(
         loader=jinja2.BaseLoader(),
         autoescape=False,
         undefined=jinja2.Undefined,