packagedquestgenforlambda (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-31221 via pytorch-lightning (0.8.1)

pytorch-lightning PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - packagedquestgenforlambda =1.0.0, =1.0.3 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

dlk (>=0.0.1, <=0.0.4) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.5)

pytorch-lightning PYPI version 1.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dlk =0.0.1, =0.0.4 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

finetuning-scheduler (0.3.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.0.post1)

pytorch-lightning PYPI version 1.8.0.post1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler 0.3.0 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

yolort (0.4.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.0rc1)

pytorch-lightning PYPI version 1.3.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - yolort 0.4.0 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

clarinpl-embeddings (>=0.0.1rc158803945536, <=0.0.1rc158956732038), cluster-depp-test (>=0.0.3, <=0.0.21) +5 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.4)

pytorch-lightning PYPI version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - clarinpl-embeddings =0.0.1rc158803945536, =0.0.3, =0.3.0, =0.3.0, =0.1.0, =0.0.0.77, =0.0.0.79 -...

nemo-toolkit (1.0.0rc1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.5)

pytorch-lightning PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.0.0rc1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

argos-trains (0.1.0), fastmri (>=0.1.0.post210716, <=0.1.1) +5 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.0.8)

pytorch-lightning PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - argos-trains 0.1.0 - fastmri =0.1.0.post210716, =0.5.1, =0.5.3 - quickvision 0.1.1rc1 - raylab 0.14.12 Source cves:...

GHSA-75M9-98V2-HJPM PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

quickvision (>=0.2.0rc1, <=0.2.1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.2.6)

pytorch-lightning PYPI version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - quickvision =0.2.0rc1, =0.2.1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

anomalib (>=0.2.2, <=0.2.4), wildtime (>=1.0.0, <=1.1.3) potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.6)

pytorch-lightning PYPI version 1.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - anomalib =0.2.2, =1.0.0, =1.1.3 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

autogluon-timeseries (>=0.6.3b20230121, <=0.6.3b20230209), contra-il6 (>=1.0.1, <=1.0.4) +17 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.6)

pytorch-lightning PYPI version 1.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon-timeseries =0.6.3b20230121, =1.0.1, =1.2.5, =1.3.2, =0.2.0, =0.1.2, =4.0.0rc0, =1.2.43, =1.0.0, =0.1.0, =0.2.1 -...

autoalbument (0.4.0), deepethogram (>=0.1.0, <=0.1.2) +8 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.8)

pytorch-lightning PYPI version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autoalbument 0.4.0 - deepethogram =0.1.0, =1.1.0, =0.2.0, =0.2.0, =0.4.0, =0.6.0 Source cves: CVE-2026-31221 Source advisory:...

admetica (>=1.3.0, <=1.4.1), adversarial-insight-ml (0.1.0) +181 more potentially affected by CVE-2026-31221 via pytorch-lightning (>=2.0.0rc0, <=2.6.0)

pytorch-lightning PYPI version =2.0.0rc0, =1.3.0, =1.8.15, =1.8.17, =1.8.14, =1.0.0, =0.9.2, =1.0.0rc1, =0.8.3b20230817, =0.8.3b20230802, =0.1.1, =0.2.2 and more Source cves: CVE-2026-31221 Source advisory: SNYK:PYTHON-PYTORCHLIGHTNING-16643334...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

UBUNTU-CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

Pytorch-Lightning security vulnerabilities

PyTorch-Lightning is an open-source lightweight PyTorch wrapper developed by Lightning AI in the United States. It is used for high-performance AI research. Versions of PyTorch-Lightning prior to 2.6.0 contain security vulnerabilities. These vulnerabilities stem from the...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() (and related checkpoint loading paths) call torch.load() without weights_only=True, allowing deserialization of ...