CVE-2026-90919

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.

  • Published Sep 14, 2026
  • CVSS 9.3 critical
  • 1.1% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-90919 at the National Vulnerability Database