LightLLM deployments that use the visual_only feature expose an unsecured Remote Procedure Call (RPyC) service. The service runs with the application's privileges and has allow_pickle enabled, meaning it accepts pickled Python objects from anyone who can reach the visual-only port. An attacker can craft a pickle payload containing a __reduce__ method, which the RPyC service will unpickle and execute, allowing arbitrary code execution. This flaw is formally classified as CWE‑502, injection of untrusted data via serialization.

The vulnerability affects the ModelTC:LightLLM product through version 1.2.0. Any deployment that has not been upgraded beyond 1.2.0 and that exposes the visual-only RPyC port is potentially vulnerable. Users running the open‑source implementation hosted on GitHub or the referenced repositories should verify the version they use.

The severity of the flaw is high, with a CVSS score of 9.3. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited. Attackers can reach the vulnerable service without authentication, exploiting the unguarded RPyC port. Since the service account privileges run with the application, code execution would occur with full privilege of that account, giving the attacker control over the system.