Description
LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ModelTC | LightLLM | ≤ 1.2.0 | — |
References
- GitHub Issue #1563 issue-tracking
- visual_websocket_endpoint pickle.loads sink at v1.2.0 technical-description
- https://github.com/ModelTC/lightllm product
- VulnCheck Advisory: LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization third-party-advisory