PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

autogluon (>=0.3.2b20220222, <=0.4.3b20220617), autogluon-text (>=0.3.2b20220222, <=0.4.1b20220510) +28 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.10.post0)

pytorch-lightning PYPI version 1.5.10.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon =0.3.2b20220222, =0.3.2b20220222, =0.3.0.dev20220423, =0.1.0, =0.0.1, =0.1.11, =0.0.2, =0.5.0, =1.0.0, =0.0.1...

pylaia (>=1.1.0, <=1.1.1rc1), pyrovelocity (0.1.1) +2 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.0)

pytorch-lightning PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pylaia =1.1.0, =1.1.1rc1 - pyrovelocity 0.1.1 - ratsnlp 0.0.9984 - ride 0.4.4 Source cves: CVE-2026-31221 Source advisory:...

pytorch-segmentation-models-trainer (0.7.0), ratsnlp (0.0.9993) potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.7)

pytorch-lightning PYPI version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.7.0 - ratsnlp 0.0.9993 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-H...

torchok (0.4.12) potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.4.post0)

pytorch-lightning PYPI version 1.8.4.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - torchok 0.4.12 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

bob-bio-face (8.0.0), bob-bio-video (7.0.0) +3 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.1)

pytorch-lightning PYPI version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - bob-bio-face 8.0.0 - bob-bio-video 7.0.0 - bob-pad-face 5.0.0 - everyvoice 0.1.20230307 - finetuning-scheduler 0.3.1 Source...

torchline (>=0.1.0, <=0.1.4.2) potentially affected by CVE-2026-31221 via pytorch-lightning (0.5.3.2)

pytorch-lightning PYPI version 0.5.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - torchline =0.1.0, =0.1.4.2 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

olorenchemengine (>=0.0.0, <=1.0.3), recsys-slates-dataset (>=0.0.5, <=0.0.6) potentially affected by CVE-2026-31221 via pytorch-lightning (1.4.1)

pytorch-lightning PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - olorenchemengine =0.0.0, =0.0.5, =0.0.6 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

simple-leftrefill-inpainting (0.0.1), tldream (>=0.1.0, <=0.4.1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.0)

pytorch-lightning PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - simple-leftrefill-inpainting 0.0.1 - tldream =0.1.0, =0.4.1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJ...

mofreinforce (>=0.0.2, <=1.0.1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.0)

pytorch-lightning PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - mofreinforce =0.0.2, =1.0.1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

autogluon-timeseries (>=0.6.3b20230121, <=0.6.3b20230209), contra-il6 (>=1.0.1, <=1.0.4) +17 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.6)

pytorch-lightning PYPI version 1.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon-timeseries =0.6.3b20230121, =1.0.1, =1.2.5, =1.3.2, =0.2.0, =0.1.2, =4.0.0rc0, =1.2.43, =1.0.0, =0.1.0, =0.2.1 -...

asteroid (>=0.3.1rc0, <=0.3.2), borisml (>=0.0.2, <=0.1.0) +3 more potentially affected by CVE-2026-31221 via pytorch-lightning (0.7.6)

pytorch-lightning PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.3.1rc0, =0.0.2, =0.1.0, =0.3.0.2, =0.3.0.4 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

deep-learning-plus (>=0.0.5, <=0.0.7), torchfl (>=0.1.1, <=0.1.5) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.7)

pytorch-lightning PYPI version 1.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - deep-learning-plus =0.0.5, =0.1.1, =0.1.5 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

anomalib (>=0.4.0rc2, <=1.0.0.dev0), ast-slizovskaia (>=0.1.1, <=0.1.4) +150 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.9.5)

pytorch-lightning PYPI version 1.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - anomalib =0.4.0rc2, =0.1.1, =0.1.0, =0.3.2b20220218, =0.6.3b20230121, =0.6.3b20230210, =0.5.62, =0.1.3, =3.3.0, =0.0.1, =0.1.0...

nemo-toolkit (1.1.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.7.post0)

pytorch-lightning PYPI version 1.3.7.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.1.0 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

eargait (3.0.0), pytorch-segmentation-models-trainer (>=0.16.0, <=0.16.1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.3)

pytorch-lightning PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - eargait 3.0.0 - pytorch-segmentation-models-trainer =0.16.0, =0.16.1 Source cves: CVE-2026-31221 Source advisory:...

axlnlp (0.0.1) potentially affected by CVE-2026-31221 via pytorch-lightning (0.7.3)

pytorch-lightning PYPI version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - axlnlp 0.0.1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

cluster-depp-test (0.0.2), depp (>=0.1.9, <=0.2.3) +2 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.0.5)

pytorch-lightning PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cluster-depp-test 0.0.2 - depp =0.1.9, =0.0.1, =0.0.3 - pytorch-lightning-help 0.0.1 Source cves: CVE-2026-31221 Source...

asteroid (>=0.1.1, <=0.2.0), torchline (>=0.2.0, <=0.2.4.3) potentially affected by CVE-2026-31221 via pytorch-lightning (0.6.0)

pytorch-lightning PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.1.1, =0.2.0, =0.2.4.3 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

dataset-format-benchmark (0.0.10) potentially affected by CVE-2026-31221 via pytorch-lightning (1.9.2)

pytorch-lightning PYPI version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dataset-format-benchmark 0.0.10 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...