CRITICALVulnerability
CVE-2026-90919
LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.
Properties
- severity
- CRITICAL
- score
- 9.8
- cve_id
- CVE-2026-90919
- signal_observed_at
- 2026-09-23T22:45:07+00:00
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- published_at
- 2026-09-14T12:17:51.807
- last_modified
- 2026-09-23T17:17:44.447
Related Entities (2)
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (1)
→[Weakness]Deserialization of Untrusted Data
Explore deeper with Ninja Signal's threat intelligence graph