Remote Code Execution Vulnerability in LightLLM Config Server
CVE-2026-90919

9.3CRITICAL

Key Information:

Vendor

Modeltc

Status
Lightllm
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90919?

A remote code execution vulnerability exists in LightLLM versions up to 1.2.0, specifically in the Config Server's unauthenticated /visual_register WebSocket endpoint. The flaw arises because this endpoint passes the initial client frame directly to the pickle.loads() function without proper validation. This allows an attacker with access to the Config Server port to send a crafted serialized payload that includes a malicious reduce method, which can lead to the execution of arbitrary code with the same privileges as the Config Server process. Mitigation of this vulnerability is essential to prevent unauthorized code execution.

Affected Version(s)

LightLLM 0 <= 1.2.0

References

https://github.com/ModelTC/LightLLM/issues/1563
issue-tracking
https://github.com/ModelTC/LightLLM/blob/v1.2.0/lightllm/...
technical-description
https://github.com/ModelTC/lightllm
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jiapeng Li
Jiajia Liu
.