CVE-2026-44484

PyTorch Lightning PyPI package versions 2.6.2 and 2.6.3 have been compromised, introducing functionality consistent with a credential harvesting mechanism. This is reflected across CVE-2026-44484 and associated advisories (GHSA-w37p-236h-pfx3; OSV). The root cause is under investigation; affected...

PyTorch Lightning security vulnerabilities

PyTorch Lightning is an open-source deep learning model pre-training and fine-tuning framework developed by Lightning AI. Version 2.6.2 and 2.6.2 of PyTorch Lightning contain security vulnerabilities, which stem from the introduction of features similar to those used in credential collection...

CVE-2026-44484: Embedded Malicious Code

PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism...

Linux Distros Unpatched Vulnerability : CVE-2026-31221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The...

CVE-2026-31214

The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 2025-20-27 contains an insecure deserialization vulnerability CWE-502. The script uses torch.load to process PyTorch checkpoint files .pt without enabling the security-restrictiv...

Deserialization of Untrusted Data

Overview ludwig is a Declarative machine learning: End-to-end machine learning pipelines using data-driven configurations. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the model serving process. An attacker can execute arbitrary code on the system by...

GHSA-PQ2F-X424-6FJM mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

EUVD-2026-29561

The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization CWE-502 in its model serving component. When starting a model server with the ludwig serve command, the framework loads model weight files using torch.load without enabling the security-restrictive weightsonly=True...

chemprobe (0.1.5), finetuning-scheduler (0.3.3) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.4)

pytorch-lightning PYPI version 1.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - chemprobe 0.1.5 - finetuning-scheduler 0.3.3 - uncertainty-estimation-models 0.1.0 Source cves: CVE-2026-31221 Source advisory...

torchok (0.4.12) potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.4.post0)

pytorch-lightning PYPI version 1.8.4.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - torchok 0.4.12 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

acids-msprior (>=1.0.1, <=1.1.3), acids-rave (>=2.1.16, <=2.3.1) +9 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.9.0)

pytorch-lightning PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - acids-msprior =1.0.1, =2.1.16, =0.0.2, =0.0.1, =0.2.6, =0.4.9, =0.4.0, =0.7.5 - swyft 0.4.2 - tencent-wedata-auto-ml 0.2.39...

finetuning-scheduler (>=0.1.3, <=0.1.4), mridc (0.1.0) +3 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.6.3)

pytorch-lightning PYPI version 1.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler =0.1.3, =0.1.0, =0.1.2 - vocalforge 0.0.4 Source cves: CVE-2026-31221 Source advisory:...

chatmof (>=0.2.0, <=0.2.2), finetuning-scheduler (0.2.0) +2 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.7.0)

pytorch-lightning PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - chatmof =0.2.0, =1.1.2, =0.3.7, =0.3.11 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

dimweb-persona-bot (0.0.6), finetuning-scheduler (0.2.2) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.7.6)

pytorch-lightning PYPI version 1.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dimweb-persona-bot 0.0.6 - finetuning-scheduler 0.2.2 - gts-engine 0.1.3 Source cves: CVE-2026-31221 Source advisory:...

asteroid (>=0.6.1rc0, <=0.6.1), autogluon (>=0.5.3b20221006, <=0.5.3) +28 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.7.7)

pytorch-lightning PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.6.1rc0, =0.5.3b20221006, =0.5.3b20221006, =0.5.3b20221006, =0.5.3b20221029, =0.0.1, =0.2.0, =2.2.4.5, =0.0.1,...

mofreinforce (>=0.0.2, <=1.0.1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.0)

pytorch-lightning PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - mofreinforce =0.0.2, =1.0.1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

locate-model (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.3)

pytorch-lightning PYPI version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - locate-model =0.0.1, =0.0.3 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

packagedquestgenforlambda (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-31221 via pytorch-lightning (0.8.1)

pytorch-lightning PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - packagedquestgenforlambda =1.0.0, =1.0.3 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

cogexquestgen (>=1.0.0, <=1.0.3), deepmorpheus (>=0.2.1, <=0.2.3) potentially affected by CVE-2026-31221 via pytorch-lightning (0.8.4)

pytorch-lightning PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cogexquestgen =1.0.0, =0.2.1, =0.2.3 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

baal (1.2.1), dpm360-lightsaber (>=0.2.0, <=0.2.5) +7 more potentially affected by CVE-2026-31221 via pytorch-lightning (0.8.5)

pytorch-lightning PYPI version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - baal 1.2.1 - dpm360-lightsaber =0.2.0, =0.1.0, =2.0.0, =0.1.2, =0.1.0, =0.0.3, =0.0.970 Source cves: CVE-2026-31221 Source...