CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() (and related checkpoint loading paths) call torch.load() without weights_only=True, allowing deserialization of ...

PT-2026-40060

Name of the Vulnerable Software and Affected Versions PyTorch-Lightning versions 2.6.0 and earlier Description An insecure deserialization issue exists in the checkpoint loading mechanism. The load from checkpoint function in LightningModule internally calls torch.load without the weights only=Tr...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

Credential Harvesting Functionality

pytorchlightning is vulnerable to credential harvesting functionality. The vulnerability is due to the introduction of functionality in versions 2.6.2 that is consistent with a credential harvesting mechanism, which allows an attacker to capture or misuse sensitive credentials through malicious...

GHSA-W37P-236H-PFX3 Compromise of PyTorch Lightning PyPi Package Versions

Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions Published: 2026-04-30 Last Updated: 2026-05-12 Github Advisory: CVE-2026-44484 We have identified a security incident affecting certain versions of one of our PyPI packages. What happened We have determined that one or more...

Compromise of PyTorch Lightning PyPi Package Versions

Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions Published: 2026-04-30 Last Updated: 2026-05-12 Github Advisory: CVE-2026-44484 We have identified a security incident affecting certain versions of one of our PyPI packages. What happened We have determined that one or more...

PT-2026-38407

Name of the Vulnerable Software and Affected Versions PyTorch Lightning versions 2.6.2 through 2.6.3 Description PyTorch Lightning, a deep learning framework used to pretrain and finetune AI models, contains compromised versions that include malicious code. This code introduces functionality...

EUVD-2021-0212

Malware in sbrugna...

EUVD-2025-6932

Malicious code in bioql PyPI...

EUVD-2025-6922

Malicious code in bioql PyPI...

EUVD-2022-0222

Malicious code in bioql PyPI...

Multiple deserialization vulnerabilities in PyTorch Lightning 2.4.0 and earlier versions

Overview PyTorch Lightning versions 2.4.0 and earlier do not use any verification mechanisms to ensure that model files are safe to load before loading them. Users of PyTorch Lightning should use caution when loading models from unknown or unmanaged sources. Description PyTorch Lightning, a...

Pytorch-Lightning Code Issue Vulnerability

Pytorch-Lightning is an open source lightweight PyTorch wrapper from Lightning AI open source in the US. Used for high performance Ai research. Pytorch-Lightning suffers from a code issue vulnerability that stems from the application's lack of effective validation of uploaded files. An attacker c...

CVE-2024-8019

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

CVE-2024-8020

A flaw was found in PyTorch Lightning. This vulnerability allows an attacker to cause a denial of service via an unexpected POST request to the /api/v1/state endpoint, leading to improper handling of state values and server shutdown. Mitigation Implementing an input validation on the server-side...

dataset-format-benchmark (>=0.0.11, <=0.0.12), hybrid-graph (>=0.2.0, <=0.61.0) +2 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.9.3)

pytorch-lightning PYPI version 1.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dataset-format-benchmark =0.0.11, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

locate-model (>=0.0.1, <=0.0.3) potentially affected by CVE-2024-8020 via pytorch-lightning (1.8.3)

pytorch-lightning PYPI version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - locate-model =0.0.1, =0.0.3 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

moai-mdk (>=0.1.1a1, <=0.1.5a34), openstf (2.6.3) potentially affected by CVE-2024-8020 via pytorch-lightning (1.5.1)

pytorch-lightning PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - moai-mdk =0.1.1a1, =0.1.5a34 - openstf 2.6.3 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...