LichtFeld-Studio Patches Vulnerability with Forged eMudhra Certificates

On November 1, 2026, LichtFeld-Studio 0.5.4.2 was released — a security update. The reason: for eight intermediate eMudhra certificate authorities, private keys can be recovered from the certificates themselves, which makes it possible to forge chains of trust. OpenSSL, which LichtFeld-Studio and its Python environment use, does not apply system-level distrust to these CAs, and the bundled uv trusted them through its own root certificates. Details are in the release description on GitHub.

What it means

LichtFeld-Studio is an open source 3D generator under the GPL-3.0 license that runs on CUDA and is designed for training, inspecting and exporting 3D Gaussian Splatting scenes. In our reference it has a dedicated tool page. The update affects the two channels through which the tool receives data from the network: its own downloads and plugin installation. Both now verify certificate chains against the public keys of the eight compromised CAs and reject them — the same way Go and Node do. The bundled uv has been updated to version 0.13.5, which rejects them as well. Dependencies were also bumped: OpenSSL 3.6.5, curl 8.23.0, FFmpeg 8.1.2, libarchive 3.8.9, libpng 1.6.59, libtiff 4.7.2, libjpeg-turbo 3.1.4.1, FreeType 2.14.3, expat 2.9.0 and assimp 6.0.5. In the LichtFeld-Studio fact sheet, the latest release was listed as v0.5.3; the current version is now 0.5.4.2. For users who install plugins or rely on the tool's downloads, this update closes the attack vector involving server substitution and arbitrary code execution through an intercepted connection.