Is CVE-2026-90919 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-90919?

CVE-2026-90919 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-90919

Description

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.