MalDet · Static Security Report
This repository has been flagged as extremely dangerous by automated security tools, with a critical vulnerability score of 588.0 and a malicious-pattern score of 122.0, indicating that the code contains severe risks that could be exploited by attackers or signs of intentional harm. The most serious issues involve the use of dynamic code loading and downloading files from the internet to execute them at runtime, which allows an attacker to potentially run arbitrary malware if the code is shared publicly. Additionally, there are multiple instances where shell commands are started without proper validation, creating a high risk for command injection attacks that could allow attackers to execute system commands on your machine. While some findings relate to standard security practices like using deprecated functions or parsing untrusted XML data, these represent common insecure coding patterns rather than evidence of malicious intent. Because the code is hosted on GitHub and appears to be public, it should not be used in any production environment without a thorough review and complete removal of all identified dangerous components.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 17 | 309 | 8260 | 8,586 |
| yara | Signatures of malicious behaviour in source files | 50 | 0 | 71 | 121 |
| guarddog | Malicious package and install-time behaviour | 8 | 2 | 12 | 22 |
259 of 8,729 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | guarddog | Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart] | 2 | /python/sglang/multimodal_gen/runtime/utils/profiler.py:202 |
| high | guarddog | Detects dynamic code loading: downloading and importing/executing code at runtime [threat-runtime-dynamic-loader] | 3 | /python/sglang/srt/utils/common.py:4515 |
| high | guarddog | Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] | 3 | /python/sglang/kernels/aot/setup_metal.py:69 |
| high | bandit | tarfile.extractall used without any validation. Please check and discard dangerous members. | 1 | /scripts/ci/slurm/analyze_logs_with_modal.py:85 |
| high | bandit | By default, jinja2 sets autoescape to False. Consider using autoescape=True or use the select_autoescape function to mitigate XSS vulnerabilities. | 1 | /python/sglang/srt/parser/template_detection.py:106 |
| high | bandit | Starting a process with a shell, possible injection detected, security issue. | 4 | /scripts/playground/lora/analyzer.py:19 |
| high | bandit | subprocess call with shell=True identified, security issue. | 11 | /scripts/code_sync/copy_from_oss.py:135 |
| high | yara | YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA c | 6 | /benchmark/hicache/bench_serving.py |
| high | yara | YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code | 2 | /python/sglang/multimodal_gen/runtime/utils/perf_logger.py |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 5 | /python/sglang/multimodal_gen/runtime/pipelines_core/stages/model_specific_stages/minimax_h3/material_io.py |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 29 | /scripts/ci_monitor/ci_auto_bisect.py |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 8 | /docker/arm64.Dockerfile |
| medium | bandit | Using xml.etree.ElementTree.XMLParser to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.XMLParser with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called | 2 | /python/sglang/srt/function_call/minicpm5_detector.py:115 |
| medium | guarddog | Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] | 1 | /benchmark/bench_linear_attention/bench_cutedsl_kda_decode.py:434 |
| medium | bandit | Use of insecure and deprecated function (mktemp). | 1 | /benchmark/hicache/bench_buffer_mode.py:261 |
| medium | bandit | Chmod setting a permissive mask 0o755 on file (script_path). | 1 | /python/sglang/multimodal_gen/benchmarks/datasets.py:175 |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 1 | /sgl-model-gateway/scripts/run_benchmarks.py:181 |
| medium | bandit | Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called | 2 | /python/sglang/srt/function_call/minicpm5_detector.py:118 |
| medium | bandit | Use of unsafe PyTorch load | 14 | /python/sglang/multimodal_gen/tools/build_modelopt_fp8_transformer.py:630 |
| medium | bandit | Use of weak SHA1 hash for security. Consider usedforsecurity=False | 14 | /python/sglang/srt/model_loader/loader.py:2088 |
| medium | bandit | Use of weak MD5 hash for security. Consider usedforsecurity=False | 1 | /scripts/ci/cuda/warmup_deep_gemm.py:387 |
| medium | bandit | Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. | 16 | /.claude/skills/sglang-prod-incident-triage/scripts/incident_artifact_tool.py:57 |
| medium | bandit | Possible SQL injection vector through string-based query construction. | 11 | /python/sglang/srt/utils/rpd_utils.py:215 |
| medium | bandit | Use of possibly insecure function - consider using safer ast.literal_eval. | 6 | /python/sglang/srt/utils/rank_consensus_checker.py:246 |
| medium | bandit | Use of exec detected. | 2 | /benchmark/io/bench_mm_token_padding.py:58 |
| medium | bandit | Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue. | 33 | /benchmark/hicache/data_processing.py:459 |
| medium | bandit | Possible binding to all interfaces. | 30 | /python/sglang/srt/entrypoints/sidecar.py:35 |
| medium | bandit | Probable insecure usage of temp file/directory. | 39 | /python/sglang/srt/utils/stale_shm_cleanup.py:20 |
| medium | bandit | Call to requests without timeout | 39 | /python/sglang/srt/entrypoints/http_server.py:2335 |
| medium | bandit | Unsafe Hugging Face Hub download without revision pinning in snapshot_download() | 11 | /python/sglang/srt/debug_utils/model_truncator.py:57 |
| medium | bandit | Unsafe Hugging Face Hub download without revision pinning in hf_hub_download() | 6 | /python/sglang/srt/model_loader/loader.py:2763 |
| medium | bandit | Unsafe Hugging Face Hub download without revision pinning in load_dataset() | 5 | /benchmark/asr/bench_sglang.py:268 |
| medium | bandit | Unsafe Hugging Face Hub download without revision pinning in from_pretrained() | 76 | /scripts/playground/lora/lora_hf_play.py:21 |
| low | bandit | Possible hardcoded password: '...' | 1 | /scripts/playground/lora/lora_hf_play.py:8 |
| low | bandit | Possible hardcoded password: '<image>' | 12 | /python/sglang/srt/multimodal/processors/internvl.py:46 |
| low | bandit | Possible hardcoded password: '<tool_call>' | 9 | /python/sglang/srt/function_call/glm47_moe_detector.py:311 |
| low | bandit | Possible hardcoded password: '</tool_call>' | 5 | /python/sglang/srt/function_call/mimo_detector.py:155 |
| low | bandit | Possible hardcoded password: 'image' | 4 | /python/sglang/multimodal_gen/configs/pipeline_configs/longcat_image.py:102 |
| low | bandit | Possible hardcoded password: '[IMG]' | 4 | /python/sglang/srt/multimodal/processors/pixtral.py:30 |
| low | bandit | Possible hardcoded password: '<|begin_of_image|>' | 2 | /python/sglang/srt/multimodal/processors/glm4v.py:457 |
| low | bandit | Possible hardcoded password: '<|video_pad|>' | 2 | /python/sglang/srt/multimodal/processors/minicpmv4_6.py:334 |
| low | bandit | Possible hardcoded password: 'concat_steps' | 2 | /python/sglang/srt/debug_utils/comparator/aligner/token_aligner/entrypoint.py:57 |
| low | bandit | Possible hardcoded password: '<im_patch>' | 2 | /python/sglang/srt/multimodal/processors/step3_vl.py:342 |
| low | bandit | Possible hardcoded password: '<｜tool▁calls▁end｜>' | 2 | /python/sglang/srt/function_call/deepseekv31_detector.py:48 |
| low | bandit | Possible hardcoded password: '<|end_of_image|>' | 2 | /python/sglang/srt/multimodal/processors/glm4v.py:458 |
| low | bandit | Possible hardcoded password: '<｜tool_calls_end｜>' | 1 | /python/sglang/srt/function_call/step3_detector.py:67 |
| low | bandit | Possible hardcoded password: '</think>' | 1 | /python/sglang/srt/function_call/deepseekv41_detector.py:20 |
| low | bandit | Possible hardcoded password: '</slice>' | 1 | /python/sglang/srt/multimodal/processors/minicpmv4_6.py:347 |
| low | bandit | Possible hardcoded password: '<|patch|>' | 1 | /python/sglang/srt/configs/muse_glimmer_processing.py:232 |
| low | bandit | Possible hardcoded password: '__sglang_reasoning_end_token_ids' | 1 | /python/sglang/srt/sampling/sampling_params.py:52 |
| low | bandit | Possible hardcoded password: '<|action_end|>' | 1 | /python/sglang/srt/function_call/internlm_detector.py:51 |
| low | bandit | Possible hardcoded password: 'ff1' | 1 | /python/sglang/srt/mem_cache/storage/tensorcast_store/tensorcast_store.py:56 |
| low | bandit | Possible hardcoded password: '｜DSML｜' | 1 | /python/sglang/srt/function_call/deepseekv32_detector.py:74 |
| low | bandit | Possible hardcoded password: '<|tools_suffix|>' | 1 | /python/sglang/srt/parser/reasoning_parser.py:1566 |
| low | bandit | Possible hardcoded password: '<|END_TEXT|>' | 1 | /python/sglang/srt/parser/reasoning_parser.py:1773 |
| low | bandit | Possible hardcoded password: '<|END_ACTION|>' | 1 | /python/sglang/srt/function_call/cohere_command4_detector.py:27 |
| low | bandit | Possible hardcoded password: '</image>' | 1 | /python/sglang/srt/multimodal/processors/minicpmv4_6.py:345 |
| low | bandit | Possible hardcoded password: '<|python_tag|>' | 1 | /python/sglang/srt/function_call/llama32_detector.py:30 |
| low | bandit | Possible hardcoded password: '✅' | 1 | /scripts/ci/utils/runner_utilization_report.py:26 |
| low | bandit | Possible hardcoded password: '<pad>' | 1 | /python/sglang/srt/multimodal/processors/pixtral.py:29 |
Showing the 60 most significant of 187 distinct findings. The counts in the previous section cover all of them.