LightLLM versions up to and including 1.2.0 expose an unauthenticated RPyC control channel that receives and deserializes pickled data sent by any network participant. Because the server process runs as the LightLLM service account, maliciously crafted pickled objects are executed with full privileges of that account, enabling an attacker to run arbitrary code on the host. The flaw is a classic deserialization vulnerability (CWE‑502) and is triggered when the application is started with the flag --pd_trans_mode nccl.

Based on the description, the vulnerability appears in LightLLM 1.2.0 and in any earlier releases that contain the same KV‑transfer worker implementation. The exact scope of earlier releases is not explicitly listed in the CVE data, so it is inferred that older versions with the nccl‑based transport module may also be impacted.

The CVSS score of 9.3 indicates high severity, and with no EPSS score available and no listing in CISA’s KEV catalog, the likelihood of exploitation cannot be precisely quantified. However, the flaw can be exercised over the network without authentication, so any host that exposes the LightLLM RPyC port to an untrusted network is at high risk. The exploitation path requires the attacker to reach the RPyC ThreadedServer endpoint, craft a malicious pickled payload, and send it, which can be done with standard network tools.