Modeltc - Lightllm - CRITICAL - CVE-2026-103395. LightLLM versions up to 1.2.0 expose an unauthenticated RPyC service with allow_pickle enabled, leading to the deserialization of attacker-controlled arguments within the remote_infer_images method. This vulnerability allows unauthorized access to the visual RPyC port, enabling attackers to pass objects crafted with __reduce__ methods, which can execute arbitrary code with the privileges of the service account.