CVE-2026-90919: Modeltc Lightllm

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.

Affected products

• Modeltc Lightllm: up to and including 1.2.0

Published 2026-09-14. Last modified 2026-09-23.