[mangeshwalsane2-hash]

Added testbed for SGLang CVE-2026-3059, Please review.

[gemini-code-assist]

Code Review

This pull request adds a reproduction and verification environment for CVE-2026-3059, which involves an unauthenticated ZeroMQ broker deserialization vulnerability in SGLang. It includes a README, a Docker Compose configuration, a custom lab server script, and a ZMTP verification script. The review feedback suggests adding defensive checks in sglang_lab_server.py when dynamically loading the scheduler client module to prevent cryptic errors if the module or its loader cannot be resolved.

[gemini-code-assist]

The importlib.util.spec_from_file_location function can return None if the file cannot be found or the spec cannot be created. Directly passing spec to importlib.util.module_from_spec without checking if it is None or if spec.loader is None will raise a cryptic ValueError or AttributeError. Adding a defensive check ensures a clear and actionable error message is raised if the file is missing or inaccessible.

spec = importlib.util.spec_from_file_location(
    "scheduler_client",
    "/sgl-workspace/sglang/python/sglang/multimodal_gen/runtime/scheduler_client.py",
)
if spec is None or spec.loader is None:
    raise ImportError("Could not load spec or loader for scheduler_client.py")
mod = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mod)