Remote Code Execution in LightLLM Config Server

Executive Summary

CVE-2026-90919 is a remote code execution vulnerability in LightLLM through version 1.2.0. It exists in the Config Server's unauthenticated /visual_register WebSocket endpoint, which uses pickle.loads() to deserialize client-provided data without authentication or input validation. Attackers can send a malicious serialized payload with a __reduce__ method to execute arbitrary code with the Config Server process privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the LightLLM Config Server's /visual_register WebSocket endpoint is exposed on your network. Use network scanning tools like nmap to identify open ports where the Config Server might be running. Example command: nmap -p- <target-ip> --open. If the endpoint is accessible without authentication, it may be vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers with network access to the Config Server to execute arbitrary code remotely. Successful exploitation could lead to full system compromise, data breaches, service disruption, or unauthorized access to sensitive information processed by the LightLLM server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A remote code execution flaw could lead to data breaches, unauthorized disclosures, or data integrity violations, resulting in regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the /visual_register WebSocket endpoint if not required. Update LightLLM to a patched version that replaces pickle with a secure serialization format like JSON and enforces authentication. Restrict network access to the Config Server port using firewalls. Monitor for unusual process activity as a potential sign of exploitation.

Useful 0 Not Useful 0