CVE-2026-103395

{
  "etk_id": "ETK-2026-164",
  "cve_id": "CVE-2026-103395",
  "display_id": "CVE-2026-103395",
  "ghsa_id": "GHSA-mw2v-h3wh-mp72",
  "euvd_id": "EUVD-2026-89990",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in LightLLM visual deployments",
  "summary": "LightLLM visual_only deployments through 1.2.0 expose an unauthenticated RPyC service that performs unsafe deserialization. An attacker able to reach that service may execute code with the privileges of the LightLLM service account.",
  "mitigation": "Immediately restrict the visual RPyC service to trusted network clients and disable pickle deserialization if the deployment supports that configuration. No fixed LightLLM version is recorded; keep the service inaccessible to untrusted networks until a vendor update is available.",
  "vendor": "ModelTC",
  "product": "LightLLM",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.2.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "LightLLM",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0062,
  "epss_percentile": 0.4859,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.586766266666666,
  "t0_at": "2026-09-30T14:48:55.734000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-30T14:48:55.734000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T14:48:55.734000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103395"
    }
  }
}