CVE-2026-103395: LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with service account privileges.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
LightLLM visual_only deployments through version 1.2.0 are exposed if their visual RPyC port is reachable by an attacker. The affected service accepts unauthenticated connections.
What does an attacker need to exploit this?
An attacker needs network access to the visual RPyC service. No authentication, privileges, or user interaction are required; the attacker can supply a crafted object to remote_infer_images.
What level of access can exploitation provide?
Successful exploitation can execute arbitrary code with the privileges of the LightLLM service account. It can affect confidentiality, integrity, and availability.
What can be done while patching is unavailable?
Restrict network access to the visual RPyC port so untrusted attackers cannot reach it. In particular, do not expose the visual_only RPyC service to untrusted networks.