LightLLM Config Server Unauthenticated RCE via Pickle Deserialization
LightLLM through v1.2.0 passes unauthenticated WebSocket frames to pickle.loads in the Config Server, enabling remote code execution on any exposed instance.
- Vendor
- ModelTC
- Product
- LightLLM
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.0%
- Status
- patched
- Published
The Config Server in LightLLM through v1.2.0 exposes a /visual_register WebSocket endpoint that passes incoming frames to pickle.loads with no authentication or input validation. Pickle deserialization of attacker-controlled data executes arbitrary code on the host.
Affected: LightLLM through v1.2.0. The Config Server is a distributed inference management component.
Fix: Update to the latest release. ModelTC’s GitHub repository is the authoritative source for patched versions.
Interim mitigation: Bind the Config Server to localhost or a private network interface and block external access to the port at the firewall until an update can be applied.
