CVE-2026-103040

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1

Description The router profiler service contains a flaw that allows remote code execution when the application is started with the --enable profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled. An attacker can execute arbitrary code by sending crafted serialized objects to the profiler command queue. Pickle deserialization is a process where a Python object is converted from a byte stream back into an object, which can be exploited to run malicious commands if the input is not trusted.

Recommendations Update to version 1.2.1 or later. As a temporary mitigation, avoid starting the service with the --enable profiling flag.