A critical remote code execution vulnerability in ModelTC LightLLM allows unauthenticated attackers to execute arbitrary code with Config Server process privileges.

The application utilizes the Python pickle library to deserialize data received from the /visual_register WebSocket endpoint without performing any validation. Because this endpoint is unauthenticated, a remote attacker can transmit a crafted malicious serialized payload containing a reduce method to achieve arbitrary code execution.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk to organizational infrastructure. Successful exploitation grants an attacker full control over the Config Server process, potentially leading to total system compromise, exfiltration of sensitive model data, or the establishment of persistent backdoors within the inference environment.

Immediate Action: There is currently no official patch available; administrators should immediately restrict access to the Config Server ports to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for unusual WebSocket connections to the /visual_register endpoint and review system logs for suspicious process spawning or unauthorized file access originating from the LightLLM service account.

Compensating Controls: Implement a Web Application Firewall (WAF) or an ingress controller rule to drop WebSocket traffic directed at the /visual_register path, or require mutual TLS (mTLS) authentication to block unauthenticated connections.

Public Exploit Available: No (exploit_available: unknown)

Given the critical nature of this flaw and the ease of exploitation, immediate isolation of the affected service is mandatory. Organizations must prioritize restricting network access to the LightLLM Config Server until a vendor-supplied patch is released and verified.