CVE-2026-58659 PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

EUVD-2026-44751

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

PT-2026-85358

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the load state function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

PT-2026-60248

Name of the Vulnerable Software and Affected Versions PyTorch Lightning versions prior to 2.6.6 Description A remote code execution issue exists in the load state function. The flaw allows the import and execution of attacker-controlled module names from checkpoint instantiator hyperparameters. A...

CVE-2026-58659: Use of Externally-Controlled Input to Select Classes or Code

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

PYSEC-2026-3043 PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

torchline (>=0.1.0, <=0.1.4.2) potentially affected by CVE-2026-31221 via pytorch-lightning (0.5.3.2)

pytorch-lightning PYPI version 0.5.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - torchline =0.1.0, =0.1.4.2 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

asteroid (>=0.1.1, <=0.2.0), torchline (>=0.2.0, <=0.2.4.3) potentially affected by CVE-2026-31221 via pytorch-lightning (0.6.0)

pytorch-lightning PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.1.1, =0.2.0, =0.2.4.3 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

benchformer (0.0.1.dev1), nerblackbox (>=0.0.5, <=0.0.10) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (0.7.1)

pytorch-lightning PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - benchformer 0.0.1.dev1 - nerblackbox =0.0.5, =0.0.10 - nlp-architect 0.5.3 Source cves: CVE-2026-31221 Source advisory:...

asteroid (>=0.3.1rc0, <=0.3.2), borisml (>=0.0.2, <=0.1.0) +3 more potentially affected by CVE-2026-31221 via pytorch-lightning (0.7.6)

pytorch-lightning PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.3.1rc0, =0.0.2, =0.1.0, =0.3.0.2, =0.3.0.4 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

cogexquestgen (>=1.0.0, <=1.0.3), deepmorpheus (>=0.2.1, <=0.2.3) potentially affected by CVE-2026-31221 via pytorch-lightning (0.8.4)

pytorch-lightning PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cogexquestgen =1.0.0, =0.2.1, =0.2.3 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

baal (1.2.1), dpm360-lightsaber (>=0.2.0, <=0.2.5) +7 more potentially affected by CVE-2026-31221 via pytorch-lightning (0.8.5)

pytorch-lightning PYPI version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - baal 1.2.1 - dpm360-lightsaber =0.2.0, =0.1.0, =2.0.0, =0.1.2, =0.1.0, =0.0.3, =0.0.970 Source cves: CVE-2026-31221 Source...

backprop (>=0.0.1, <=0.0.2), kiri (>=0.5.0.dev1, <=0.5.1) +3 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.0)

pytorch-lightning PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - backprop =0.0.1, =0.5.0.dev1, =1.0.2, =0.1.1rc3, =0.1.1 - ragcar 0.1.0 Source cves: CVE-2026-31221 Source advisory:...

mimikit (>=0.1.0, <=0.1.10), pytorch-hyperlight (0.1.3) potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.2)

pytorch-lightning PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - mimikit =0.1.0, =0.1.10 - pytorch-hyperlight 0.1.3 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

nemo-toolkit (1.0.0rc1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.5)

pytorch-lightning PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.0.0rc1 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

autoalbument (0.4.0), deepethogram (>=0.1.0, <=0.1.2) +8 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.8)

pytorch-lightning PYPI version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autoalbument 0.4.0 - deepethogram =0.1.0, =1.1.0, =0.2.0, =0.2.0, =0.4.0, =0.6.0 Source cves: CVE-2026-31221 Source advisory:...

ratsnlp (>=0.0.971, <=0.0.997) potentially affected by CVE-2026-31221 via pytorch-lightning (1.2.3)

pytorch-lightning PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - ratsnlp =0.0.971, =0.0.997 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

mimikit (>=0.2.3, <=0.2.6) potentially affected by CVE-2026-31221 via pytorch-lightning (1.2.4)

pytorch-lightning PYPI version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - mimikit =0.2.3, =0.2.6 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

deepbio (0.0.1), deepprot (0.12.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.2.5)

pytorch-lightning PYPI version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - deepbio 0.0.1 - deepprot 0.12.0 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...