This vulnerability allows an attacker to execute arbitrary code with the privileges of the LightLLM server process. The LightLLM embed cache service runs an unauthenticated RPyC server that deserializes Python pickle objects, which are fully trusted. A crafted serialized payload can trigger arbitrary code paths inside the service, leading to full compromise of the host, data exfiltration, persistence, or further lateral movement. The weakness is classified as CWE-502, an Untrusted Serialized Data flaw.

The affected product is LightLLM, the multimodal inference library from ModelTC, up to and including version 1.2.0. Deployments that enable the embed cache service expose the RPyC endpoint on all interfaces, meaning normal or hosted installations of this version are susceptible.

With a CVSS score of 9.3 the vulnerability is considered Critical. No EPSS score is available, and it is not listed in the CISA KEV catalog. The service is bound to all network interfaces and requires no authentication, so the likely attack vector is remote network. An attacker can send malicious pickled data to any public or internal IP address running the vulnerable LightLLM version to gain full code execution on the host.