LightLLM versions 1.1.0 and earlier contain an unsafe deserialization flaw in the PD (prefill-decode) disaggregation mode. The application exposes WebSocket endpoints that accept binary frames and feed them directly to pickle.loads() without any authentication or input validation. This design allows a remote attacker who can reach the PD master node to supply a crafted pickle payload that is executed with the privileges of the running process, providing full control over the system. The vulnerability is classified as CWE-502 and carries a CVSS base score of 9.3, indicating a severe threat to confidentiality, integrity, and availability.

The flaw affects all installations of ModelTC LightLLM with version 1.1.0 or lower that use PD mode. No specific patch versions have been listed in the data; the issue is inherent to the vulnerable code paths in these releases.

The CVSS score of 9.3 combined with an EPSS less than 1 % suggests the vulnerability is highly severe but currently has a low probability of being exploited in the wild. The lack of authentication or input checks means an attacker can exploit it remotely via a WebSocket connection to the PD master node. The vulnerability is not listed in CISA’s KEV catalog, implying no confirmed exploit activity to date. The attack surface is limited to systems that expose the WebSocket endpoints publicly or to untrusted networks.