CVE-2024-5452

🗓️ 06 Jun 2024 17:54:57Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

RCE vulnerability in lightning-ai/pytorch-lightning v2.2.1 due to improper handling of deserialized user input

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for Improper Control of Dynamically-Managed Code Resources in Lightningai Pytorch_Lightning	22 Nov 202406:56	–	githubexploit
GithubExploit	Exploit for Improper Control of Dynamically-Managed Code Resources in Lightningai Pytorch_Lightning	9 Feb 202500:14	–	githubexploit
Circl	CVE-2024-5452	11 Jun 202413:54	–	circl
CNNVD	Pytorch-Lightning Security Vulnerability	6 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-5452 RCE via Property/Class Pollution in lightning-ai/pytorch-lightning	6 Jun 202417:54	–	cvelist
Github Security Blog	Remote code execution in pytorch lightning	6 Jun 202418:30	–	github
NVD	CVE-2024-5452	6 Jun 202418:15	–	nvd
OSV	GHSA-CGWC-QVRX-RF7F Remote code execution in pytorch lightning	6 Jun 202418:30	–	osv
Positive Technologies	PT-2024-36377 · Unknown +1 · Pytorch-Lightning +1	6 Jun 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-5452	5 Feb 202506:15	–	redhatcve

NVD

Vulners

Vulnrichment

Node

lightningai pytorch_lightningRange<2.3.3python

[
  {
    "vendor": "lightning-ai",
    "product": "lightning-ai/pytorch-lightning",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.3.3",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a
huntr	www.huntr.com/bounties/486add92-275e-4a7b-92f9-42d84bc759da

Parameter	Position	Path	Description	CWE
delta	request body	api/v1/delta	RCE via deserialization of delta data passed to /api/v1/delta, allowing dunder attribute pollution and arbitrary code execution.	CWE-913, CWE-915

15 Oct 2025 13:15Current

9.9High risk

Vulners AI Score9.9

CVSS 3.19.8

CVSS 39.8

EPSS0.50542

SSVC