github-acc-test (>=0.0.1, <=0.3.1), libmultilabel (>=0.0.1, <=0.1.4) +3 more potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.5)

pytorch-lightning PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - github-acc-test =0.0.1, =0.0.1, =0.0.1rc1, =0.1.0, =1.0.0rc1, =1.0.1 Source cves: CVE-2026-58659 Source advisory:...

anomalib (>=0.2.2, <=0.2.4), wildtime (>=1.0.0, <=1.1.3) potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.6)

pytorch-lightning PYPI version 1.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - anomalib =0.2.2, =1.0.0, =1.1.3 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

pytorch-segmentation-models-trainer (0.7.0), ratsnlp (0.0.9993) potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.7)

pytorch-lightning PYPI version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.7.0 - ratsnlp 0.0.9993 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

nemo-toolkit (1.1.0) potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.7.post0)

pytorch-lightning PYPI version 1.3.7.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.1.0 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

bio-transformers (>=0.0.7, <=0.1.2), biome-text (>=3.0.0, <=3.2.1) +21 more potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.8)

pytorch-lightning PYPI version 1.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - bio-transformers =0.0.7, =3.0.0, =0.5.9, =0.1.0, =0.0.22, =0.0.11, =0.7.1, =0.4.5, =0.4.6 and more Source cves: CVE-2026-58659...

pytorch-segmentation-models-trainer (0.11.0) potentially affected by CVE-2026-58659 via pytorch-lightning (1.4.3)

pytorch-lightning PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.11.0 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

asteroid (>=0.5.0rc0, <=0.5.0), backprop (>=0.0.3, <=0.1.3) +12 more potentially affected by CVE-2026-58659 via pytorch-lightning (1.2.10)

pytorch-lightning PYPI version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.5.0rc0, =0.0.3, =0.3.0b1, =1.0.0, =0.3.1.0, =2.0.0, =1.0.4, =0.8.1, =1.0.0, =0.1.0, =0.2.0 Source cves:...

yolort (0.4.0) potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.0rc1)

pytorch-lightning PYPI version 1.3.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - yolort 0.4.0 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

geniverse (>=0.0.1, <=0.0.12.12), hugging-gan-test (>=0.0.1, <=0.2.29) +1 more potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.3)

pytorch-lightning PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - geniverse =0.0.1, =0.0.1, =0.2.29 - ratsnlp 0.0.9983 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

ratsnlp (>=0.0.9981, <=1.0.51) potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.4)

pytorch-lightning PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - ratsnlp =0.0.9981, =1.0.51 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

gradsflow (>=0.0.1b1, <=0.0.3), pytorch-lightning-spells (>=0.0.4, <=0.0.5) potentially affected by CVE-2026-58659 via pytorch-lightning (1.4.0)

pytorch-lightning PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - gradsflow =0.0.1b1, =0.0.4, =0.0.5 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

olorenchemengine (>=0.0.0, <=1.0.3), recsys-slates-dataset (>=0.0.5, <=0.0.6) potentially affected by CVE-2026-58659 via pytorch-lightning (1.4.1)

pytorch-lightning PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - olorenchemengine =0.0.0, =0.0.5, =0.0.6 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

bigdl (2.0.0), bigdl-spark2 (2.0.0) +9 more potentially affected by CVE-2026-58659 via pytorch-lightning (1.4.2)

pytorch-lightning PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - bigdl 2.0.0 - bigdl-spark2 2.0.0 - bigdl-spark3 2.0.0 - classy-imaginary 0.3.5 - imaginairy =0.7.2, =1.1.1rc2, =2.0.14, =2.1.0...

torchok (0.4.12) potentially affected by CVE-2026-58659 via pytorch-lightning (1.8.4.post0)

pytorch-lightning PYPI version 1.8.4.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - torchok 0.4.12 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

CVE-2026-58659

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

CVE-2026-58659

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

CVE-2026-58659 PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

CVE-2026-58659

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

CVE-2026-58659

Summary: CVE-2026-58659 affects PyTorch Lightning up to version 2.6.5. The vulnerability lies in the _load_state function, which can import and execute attacker-controlled module names from the checkpoint _instantiator hyperparameters, enabling remote code execution when LightningModule.load_from...

CVE-2026-58659 PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...