CVE-2026-103041

LightLLM versions through 1.2.0 in multimodal deployments are vulnerable to Remote Code Execution (RCE) . The flaw exists because an unauthenticated RPyC cache service is exposed on all interfaces with pickle deserialization enabled. An attacker can send crafted serialized objects to the exposed ...