CVE-2026-31221

A flaw was found in PyTorch-Lightning. This vulnerability, categorized as insecure deserialization CWE-502, exists in the checkpoint loading mechanism. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, which, when loaded by the LightningModule.loadfromcheckpoi...

CVE-2026-58659

A flaw was found in PyTorch Lightning. This vulnerability allows attackers to achieve remote code execution by crafting malicious checkpoint files. These files exploit a weakness in the loadstate function, which imports and executes attacker-controlled module names from checkpoint instantiator...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the loadstate function that imports a...

GHSA-QQMF-GPG7-G8GW PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

PYSEC-2026-3624

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

PYSEC-2026-3967

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

PYSEC-2026-3967

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

deep-learning-plus (>=0.0.5, <=0.0.7), torchfl (>=0.1.1, <=0.1.5) potentially affected by CVE-2026-58659 via pytorch-lightning (1.5.7)

pytorch-lightning PYPI version 1.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - deep-learning-plus =0.0.5, =0.1.1, =0.1.5 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

asteroid (>=0.1.1, <=0.2.0), torchline (>=0.2.0, <=0.2.4.3) potentially affected by CVE-2026-58659 via pytorch-lightning (0.6.0)

pytorch-lightning PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.1.1, =0.2.0, =0.2.4.3 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

benchformer (0.0.1.dev1), nerblackbox (>=0.0.5, <=0.0.10) +1 more potentially affected by CVE-2026-58659 via pytorch-lightning (0.7.1)

pytorch-lightning PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - benchformer 0.0.1.dev1 - nerblackbox =0.0.5, =0.0.10 - nlp-architect 0.5.3 Source cves: CVE-2026-58659 Source advisory:...

databalancer (>=0.0.7, <=0.0.8), torchline (>=0.3.0.0a0, <=0.3.0.1) potentially affected by CVE-2026-58659 via pytorch-lightning (0.7.5)

pytorch-lightning PYPI version 0.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - databalancer =0.0.7, =0.3.0.0a0, =0.3.0.1 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

cogexquestgen (>=1.0.0, <=1.0.3), deepmorpheus (>=0.2.1, <=0.2.3) potentially affected by CVE-2026-58659 via pytorch-lightning (0.8.4)

pytorch-lightning PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cogexquestgen =1.0.0, =0.2.1, =0.2.3 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

baal (1.2.1), dpm360-lightsaber (>=0.2.0, <=0.2.5) +7 more potentially affected by CVE-2026-58659 via pytorch-lightning (0.8.5)

pytorch-lightning PYPI version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - baal 1.2.1 - dpm360-lightsaber =0.2.0, =0.1.0, =2.0.0, =0.1.2, =0.1.0, =0.0.3, =0.0.970 Source cves: CVE-2026-58659 Source...

asteroid (>=0.3.5, <=0.4.0), coreml (>=0.0.10, <=0.0.15) +8 more potentially affected by CVE-2026-58659 via pytorch-lightning (0.9.0)

pytorch-lightning PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.3.5, =0.0.10, =0.0.1, =0.0.2.post1, =1.0.0a4, =0.4.1, =0.2.1, =0.13.6, =0.1.0, =0.1.1 - torch-factorization-models...

cluster-depp-test (0.0.2), depp (>=0.1.9, <=0.2.3) +2 more potentially affected by CVE-2026-58659 via pytorch-lightning (1.0.5)

pytorch-lightning PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cluster-depp-test 0.0.2 - depp =0.1.9, =0.0.1, =0.0.3 - pytorch-lightning-help 0.0.1 Source cves: CVE-2026-58659 Source...

moai-mdk (>=0.1.0a1, <=0.1.0a2) potentially affected by CVE-2026-58659 via pytorch-lightning (1.0.7)

pytorch-lightning PYPI version 1.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - moai-mdk =0.1.0a1, =0.1.0a2 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

pytorch-quantum (>=0.1.0.dev1, <=0.1.0.dev3) potentially affected by CVE-2026-58659 via pytorch-lightning (1.1.1)

pytorch-lightning PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-quantum =0.1.0.dev1, =0.1.0.dev3 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

nemo-toolkit (1.0.0rc1) potentially affected by CVE-2026-58659 via pytorch-lightning (1.1.5)

pytorch-lightning PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.0.0rc1 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

lightning-flash (>=0.1.0, <=0.2.1) potentially affected by CVE-2026-58659 via pytorch-lightning (1.2.0rc0)

pytorch-lightning PYPI version 1.2.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - lightning-flash =0.1.0, =0.2.1 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...