<!-- generated by scripts/build-docs-site.py — edit the generator, not this file -->
# Vulnerability research ledger / 漏洞研究台账

**Version 0.2.0 · last generated 2026-10-27**

## English

### How an entry gets counted

An entry is called zero-day only when dynamic reproduction succeeded *and* the novelty check returned “confirmed unpublished”. The other inventory rows are research leads, not zero-day. A finding that turns out to be public later is downgraded, and the downgrade is recorded. The same sink is not counted twice.

| Inventory | Dynamically verified | Confirmed unpublished (0-day) | Confirmed rows | Unique primitives | Components | Inconclusive |
|---:|---:|---:|---:|---:|---:|---:|
| 169 | 60 | 47 | 46 | 39 | 21 | 0 |

The table below lists the 39 unique primitives. It is deliberately limited to component, class, affected versions,
status and the disclosure window. It does **not** contain runnable code, exploit steps, request bodies or
root-cause locations.

### Confirmed 0-day list

| Component | Class | Affected versions | Status | Disclosure window |
|---|---|---|---|---|
| `vllm-jev` | Authentication bypass | v0.31.0 · 57226d4 | Reported | 2026-10-27 → 2027-01-25 |
| `djev` | Authentication bypass, open relay | e5841cf | Reported | 2026-10-27 → 2027-01-25 |
| `slime` | Path traversal | 05e3b01 · SGLang 0.5.15.post1 | Reported | 2026-10-27 → 2027-01-25 |
| `sglang-omni` | Auth fail-open | 204ba29 | Reported | 2026-10-27 → 2027-01-25 |
| `skyrl` | Unsafe deserialisation | a1e34db | Reported | 2026-10-27 → 2027-01-25 |
| `skyrl` | Missing authentication | a1e34db | Reported | 2026-10-27 → 2027-01-25 |
| `trl` | Missing authentication | 1.15.0 | Reported | 2026-10-27 → 2027-01-25 |
| `areal` | Unauthenticated code execution | 448de52 | Reported | 2026-10-27 → 2027-01-25 |
| `areal` | Deserialisation | 448de52 | Reported | 2026-10-27 → 2027-01-25 |
| `openrlhf` | Missing authentication | 0.11.2 · dc2a7ad | Reported | 2026-10-27 → 2027-01-25 |
| `msswift` | Unsafe model loading | 4.5.3 · fbc61cf | Reported | 2026-10-27 → 2027-01-25 |
| `verl` | Code execution (eval/exec) | 76e837e | Reported | 2026-10-27 → 2027-01-25 |
| `verl` | Deserialisation over TCP | 76e837e | Reported | 2026-10-27 → 2027-01-25 |
| `skyrl` | Path traversal | a1e34db | Reported | 2026-10-27 → 2027-01-25 |
| `openrlhf` | Insecure serialisation | 0.11.2 · dc2a7ad | Reported | 2026-10-27 → 2027-01-25 |
| `areal` | Unsafe deserialisation | 448de52 | Reported | 2026-10-27 → 2027-01-25 |
| `slime` | Unsafe deserialisation | 05e3b01 | Reported | 2026-10-27 → 2027-01-25 |
| `openjev` | Code execution via release hook | b4339c6 | Reported | 2026-10-27 → 2027-01-25 |
| `msswift` | Sandbox escape | 4.5.3 · fbc61cf | Reported | 2026-10-27 → 2027-01-25 |
| `areal` | Unauthenticated control plane | 448de52 | Reported | 2026-10-27 → 2027-01-25 |
| `onejev` | Server-side request forgery | 6122519 | Reported | 2026-10-27 → 2027-01-25 |
| `llm2jev` | Local file read | f2bdad6 | Reported | 2026-10-27 → 2027-01-25 |
| `siliconlab` | Credential exposure | a08e969 | Reported | 2026-10-27 → 2027-01-25 |
| `verl` | Command injection | 76e837e | Reported | 2026-10-27 → 2027-01-25 |
| `dify` | Unauthenticated RCE | v1.17.1 | Reported | 2026-10-27 → 2027-01-25 |
| `dify` | Auth fail-open | v1.17.1 · bbfac7a | Reported | 2026-10-27 → 2027-01-25 |
| `dify` | Hardcoded key | v1.17.1 | Reported | 2026-10-27 → 2027-01-25 |
| `dify` | Cross-tenant access | v1.17.1 | Reported | 2026-10-27 → 2027-01-25 |
| `open-webui` | Sandbox escape | v0.12.3 · 91ea4e3 | Reported | 2026-10-27 → 2027-01-25 |
| `vllm` | Authentication bypass | v0.32.0 | Reported | 2026-10-27 → 2027-01-25 |
| `deepspeed` | Unsafe deserialisation | v0.19.8 | Reported | 2026-10-27 → 2027-01-25 |
| `msswift` | Local file read | v4.6.0 | Reported | 2026-10-27 → 2027-01-25 |
| `deepspeed` | Unsafe deserialisation | v0.19.8 | Reported | 2026-10-27 → 2027-01-25 |
| `deepspeed` | Unsafe deserialisation | v0.19.8 | Reported | 2026-10-27 → 2027-01-25 |
| `llamafactory` | Unsafe deserialisation | v0.9.5 | Reported | 2026-10-27 → 2027-01-25 |
| `megatron` | Unsafe deserialisation | core_v0.19.2 | Reported | 2026-10-27 → 2027-01-25 |
| `msswift` | Deserialisation | v4.6.0 | Reported | 2026-10-27 → 2027-01-25 |
| `msswift` | Deserialisation | v4.6.0 | Reported | 2026-10-27 → 2027-01-25 |
| `msswift` | Deserialisation | v4.6.0 | Reported | 2026-10-27 → 2027-01-25 |

### Disclosure

Vendors were notified through the coordinated-disclosure process. Exploit details stay private until the fix window
closes and are then published with the advisory.

- Policy: vendor first; 90-day window; national CERT only if the vendor does not respond.
- Prepared: 30 CVE-ready packages and 6 hardening-only notes. Advisory text is not public until the window closes.
- Dates above are targets. A vendor that asks for more time gets it, in writing, and the table is updated.
- Status values: `Reported` = vendor notified; `Advisory` = published after the window.

### What is withheld, and why

A version string and a class are enough for a defender to check exposure. An exploit is not. Withholding the second
while publishing the first is the whole point of coordinated disclosure: defenders can act, attackers get no head
start.

---

## 中文

### 计数规则

只有一条，没有例外：动态复现成功、且查新结论为“确认未公开”的条目才能进入储备。事后发现已公开的，降级并留痕。
同一个 sink 不重复计数。

| 库存 | 动态验证 | 确认未公开 | 储备行 | 独立原语 | 组件 | 存疑 |
|---:|---:|---:|---:|---:|---:|---:|
| 169 | 60 | 47 | 46 | 39 | 21 | 0 |

下表列出 39 条独立原语，只包含组件、类别、受影响版本、状态与披露窗口。**不包含** 可执行代码、利用步骤、请求内容或根因位置。

### 储备清单

| 组件 | 漏洞类别 | 受影响版本 | 状态 | 披露时间线 |
|---|---|---|---|---|
| `vllm-jev` | 认证绕过 | v0.31.0 · 57226d4 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `djev` | 认证绕过、开放中继 | e5841cf | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `slime` | 路径穿越 | 05e3b01 · SGLang 0.5.15.post1 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `sglang-omni` | 鉴权失效（fail-open） | 204ba29 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `skyrl` | 不安全反序列化 | a1e34db | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `skyrl` | 缺少鉴权 | a1e34db | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `trl` | 缺少鉴权 | 1.15.0 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `areal` | 未授权代码执行 | 448de52 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `areal` | 反序列化 | 448de52 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `openrlhf` | 缺少鉴权 | 0.11.2 · dc2a7ad | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `msswift` | 不安全模型加载 | 4.5.3 · fbc61cf | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `verl` | 代码执行（eval/exec） | 76e837e | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `verl` | TCP 反序列化 | 76e837e | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `skyrl` | 路径穿越 | a1e34db | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `openrlhf` | 不安全序列化 | 0.11.2 · dc2a7ad | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `areal` | 不安全反序列化 | 448de52 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `slime` | 不安全反序列化 | 05e3b01 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `openjev` | 发布钩子代码执行 | b4339c6 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `msswift` | 沙箱逃逸 | 4.5.3 · fbc61cf | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `areal` | 未授权控制面 | 448de52 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `onejev` | 服务端请求伪造 | 6122519 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `llm2jev` | 本地文件读取 | f2bdad6 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `siliconlab` | 凭据泄露 | a08e969 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `verl` | 命令注入 | 76e837e | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `dify` | 未授权 RCE | v1.17.1 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `dify` | 鉴权失效（fail-open） | v1.17.1 · bbfac7a | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `dify` | 硬编码密钥 | v1.17.1 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `dify` | 跨租户访问 | v1.17.1 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `open-webui` | 沙箱逃逸 | v0.12.3 · 91ea4e3 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `vllm` | 认证绕过 | v0.32.0 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `deepspeed` | 不安全反序列化 | v0.19.8 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `msswift` | 本地文件读取 | v4.6.0 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `deepspeed` | 不安全反序列化 | v0.19.8 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `deepspeed` | 不安全反序列化 | v0.19.8 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `llamafactory` | 不安全反序列化 | v0.9.5 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `megatron` | 不安全反序列化 | core_v0.19.2 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `msswift` | 反序列化 | v4.6.0 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `msswift` | 反序列化 | v4.6.0 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |
| `msswift` | 反序列化 | v4.6.0 | 已上报 | 2026-10-27 → 2027-01-25（90 天） |

### 披露说明

已按协调披露流程通知厂商。利用细节在修复窗口结束前保持非公开，窗口结束后随 advisory 一并发布。

- 政策：厂商优先；90 天窗口；厂商不回应才转国家级 CERT。
- 已准备：30 份 CVE 就绪包、6 份加固建议。窗口结束前 advisory 正文不公开。
- 表中的日期是目标值。厂商书面申请延期会给，并同步更新表格。
- 状态取值：`已上报` = 已通知厂商；`Advisory` = 窗口结束后已发布。

### 为什么不公开细节

版本号加类别，足够防守方判断暴露面；利用代码不够。公开前者、扣住后者，正是协调披露的意义：防守方可以行动，
攻击者拿不到先手。