CVE-2026-90919

CRITICAL 9.8CVE-2026-90919 · Published 14/09/2026 · updated 23/09/2026

In short

CVE-2026-90919 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.

References

ModelTC/LightLLM
ModelTC/LightLLM
ModelTC/lightllm
vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-config-server-pickle-deserialization

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free