Remote Code Execution in LightLLM Config Server via Insecure Deserialization

LightLLM versions through 1.2.0 contain a critical remote code execution (RCE) vulnerability in the Config Server component. The vulnerability resides in the /visual_register WebSocket endpoint, which fails to implement any authentication mechanisms. The application insecurely handles client-provided frames by passing the first frame directly to the Python pickle.loads() function. An unauthenticated attacker capable of reaching the Config Server network port can send a maliciously crafted, serialized pickle payload containing a reduce method. Successful exploitation allows the attacker to execute arbitrary code within the context of the Config Server process. Given the nature of pickle-based deserialization vulnerabilities, this flaw poses a high risk to environment integrity, as it grants full execution capabilities to remote, unauthenticated parties.

Attack Chain

1. Attacker performs network reconnaissance to identify reachable Config Server endpoints.
2. Attacker establishes a WebSocket connection to the /visual_register endpoint on the target server.
3. Attacker crafts a malicious Python object payload using the pickle module's reduce method.
4. Attacker sends the serialized binary data as the first frame over the established WebSocket.
5. The Config Server component receives the payload and passes the data to pickle.loads().
6. The Python interpreter deserializes the malicious object, triggering the execution of the embedded instructions.
7. Attacker achieves arbitrary code execution with the permissions of the underlying service account.

Impact

Successful exploitation of CVE-2026-90919 allows for complete compromise of the affected Config Server process. In enterprise environments, this could lead to lateral movement, data exfiltration, or deployment of further persistence mechanisms. There is currently no mitigation or patch specified; users should restrict network access to the Config Server port.

Recommendation

Prioritize network segmentation to ensure the LightLLM Config Server port is not accessible from untrusted or external networks. Monitor application logs for unexpected WebSocket connection attempts to the /visual_register URI.