VulnSocial

CVE-2026-90919Patch

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-09-14); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-14: 1Mentions · 2026-09-15: 1Mentions · 2026-09-18: 1Patch / Workaround · 2026-09-14: 1Patch / Workaround · 2026-09-18: 1Technical Details · 2026-09-14: 1Technical Details · 2026-09-15: 1Technical Details · 2026-09-18: 109-1409-1509-18
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-141
Patch1
2026-09-151
Disclosure1
2026-09-181
Patch1
Full discourse3 posts
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: LightLLM CVE-2026-90919 (CVSS 9.8) lets an unauthenticated attacker hit /visual_register and run code via pickle.loads. Hits LightLLM through 1.2.0. Lock Config Server off the public net; upgrade when a fixed build ships. https://www.rapid7.com/db/vulnerabilities/cve-2026-90919/

    Post summary

    The text discloses a critical unauthenticated RCE vulnerability in LightLLM (CVE-2026-90919) via pickle.loads with a CVSS of 9.8, while primarily emphasizing a specific workaround (isolating the Config Server) and a future fix (upgrade when available).

    0000068
    3.0K followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen CVE-2026-90919: Kritische RCE-Lücke in LightLLM bis Version 1.2.0 #cve202690919 #lightllm #pickle #remotecodeexecution #websocket https://cybersecurity-news.de/cve-2026-90919-lightllm-rce-bis-1-2-0

    Post summary

    The tweet announces CVE-2026-90919 as a critical RCE in LightLLM (≤1.2.0) via pickle deserialization over WebSocket, linking to a news article for further details, but provides no PoC, exploit tool, patch, or active exploitation evidence.

    0000034
    12 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - LightLLM Config Server WebSocket Pickle RCE (CVE-2026-90919) LightLLM Config Server /visual_register WebSocket passes the first client frame directly into pickle.loads(). Unauthenticated attackers with network access to the Config Server port can send a malicious pickle (__reduce__) to execute arbitrary code as the Config Server process. Instances not exposing the Config Server port externally are not impacted. 👉Affected: LightLLM <= 1.2.0

    Post summary

    The tweet discloses a critical unauthenticated RCE in LightLLM Config Server (CVE-2026-90919) via pickle deserialization in the WebSocket handler, affecting versions up to 1.2.0, and notes that not exposing the Config Server port externally serves as a workaround.

    0000080
    304 followersView on X

Explore more

Back to dashboard