CVE-2026-90919

LightLLM through version 1.2.0 contains a critical remote code execution flaw in the Config Server's unauthenticated /visual_register WebSocket endpoint, which passes the first client frame directly to pickle.loads() without validation. An attacker who can reach the Config Server port can send a single crafted serialized payload containing a __reduce__ method, causing arbitrary code to execute with the privileges of the Config Server process. The flaw requires no authentication, no user interaction, and is network-exploitable, resulting in a CVSS 4.0 score of 9.3 (critical). Any deployment of LightLLM up to and including 1.2.0 that allows untrusted networks to reach the Config Server port is affected. No public proof-of-concept is known and the CVE is not in CISA's KEV catalog, so exploitation is feasible but not yet observed in the wild.

What to do: Upgrade LightLLM to a release newer than 1.2.0 as soon as a patched version is available. Until then, restrict network access to the Config Server port (firewall allowlisting, or bind it to localhost/internal interfaces) and ensure the /visual_register WebSocket endpoint is never reachable from untrusted networks. Because the bug is unauthenticated RCE, review Config Server logs for unexpected WebSocket connections and check affected hosts for signs of post-exploitation.