PT-2026-85358

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the load state function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...