CVE-2024-7804

A flaw was found in PyTorch. This vulnerability allows an attacker to execute arbitrary code remotely via a maliciously crafted serialized PythonUDF object. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security...

CVE-2024-8019

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

CVE-2024-8020

A flaw was found in PyTorch Lightning. This vulnerability allows an attacker to cause a denial of service via an unexpected POST request to the /api/v1/state endpoint, leading to improper handling of state values and server shutdown. Mitigation Implementing an input validation on the server-side...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2025-1474 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2025-0453 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2025-0453 Source advisory: OSV:GHSA-49M6-VRR9-2CQM...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-8859 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-8859 Source advisory: OSV:GHSA-4RQF-8PFM-P36R...

GHSA-98FP-7V67-4V3Q PyTorch Lightning denial of service vulnerability

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

torchline (>=0.1.0, <=0.1.4.2) potentially affected by CVE-2024-8020 via pytorch-lightning (0.5.3.2)

pytorch-lightning PYPI version 0.5.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - torchline =0.1.0, =0.1.4.2 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

asteroid (>=0.1.1, <=0.2.0), torchline (>=0.2.0, <=0.2.4.3) potentially affected by CVE-2024-8020 via pytorch-lightning (0.6.0)

pytorch-lightning PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.1.1, =0.2.0, =0.2.4.3 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

benchformer (0.0.1.dev1), nerblackbox (>=0.0.5, <=0.0.10) +1 more potentially affected by CVE-2024-8020 via pytorch-lightning (0.7.1)

pytorch-lightning PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - benchformer 0.0.1.dev1 - nerblackbox =0.0.5, =0.0.10 - nlp-architect 0.5.3 Source cves: CVE-2024-8020 Source advisory:...

axlnlp (0.0.1) potentially affected by CVE-2024-8020 via pytorch-lightning (0.7.3)

pytorch-lightning PYPI version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - axlnlp 0.0.1 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

databalancer (>=0.0.7, <=0.0.8), torchline (>=0.3.0.0a0, <=0.3.0.1) potentially affected by CVE-2024-8020 via pytorch-lightning (0.7.5)

pytorch-lightning PYPI version 0.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - databalancer =0.0.7, =0.3.0.0a0, =0.3.0.1 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

asteroid (>=0.3.1rc0, <=0.3.2), borisml (>=0.0.2, <=0.1.0) +3 more potentially affected by CVE-2024-8020 via pytorch-lightning (0.7.6)

pytorch-lightning PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.3.1rc0, =0.0.2, =0.1.0, =0.3.0.2, =0.3.0.4 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

packagedquestgenforlambda (>=1.0.0, <=1.0.3) potentially affected by CVE-2024-8020 via pytorch-lightning (0.8.1)

pytorch-lightning PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - packagedquestgenforlambda =1.0.0, =1.0.3 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

cogexquestgen (>=1.0.0, <=1.0.3), deepmorpheus (>=0.2.1, <=0.2.3) potentially affected by CVE-2024-8020 via pytorch-lightning (0.8.4)

pytorch-lightning PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cogexquestgen =1.0.0, =0.2.1, =0.2.3 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

baal (1.2.1), dpm360-lightsaber (>=0.2.0, <=0.2.5) +7 more potentially affected by CVE-2024-8020 via pytorch-lightning (0.8.5)

pytorch-lightning PYPI version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - baal 1.2.1 - dpm360-lightsaber =0.2.0, =0.1.0, =2.0.0, =0.1.2, =0.1.0, =0.0.3, =0.0.970 Source cves: CVE-2024-8020 Source...

asteroid (>=0.3.5, <=0.4.0), coreml (>=0.0.10, <=0.0.15) +8 more potentially affected by CVE-2024-8020 via pytorch-lightning (0.9.0)

pytorch-lightning PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.3.5, =0.0.10, =0.0.1, =0.0.2.post1, =1.0.0a4, =0.4.1, =0.2.1, =0.13.6, =0.1.0, =0.1.1 - torch-factorization-models...

formerbox (>=0.1.8, <=0.1.10), npvcc2016 (>=1.0.3, <=1.2.1) +2 more potentially affected by CVE-2024-8020 via pytorch-lightning (0.10.0)

pytorch-lightning PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - formerbox =0.1.8, =1.0.3, =1.2.1 - pytorch-forecasting 0.5.0 - pytorch-pqrnn 0.1.0 Source cves: CVE-2024-8020 Source advisory...

cluster-depp-test (0.0.2), depp (>=0.1.9, <=0.2.3) +2 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.0.5)

pytorch-lightning PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cluster-depp-test 0.0.2 - depp =0.1.9, =0.0.1, =0.0.3 - pytorch-lightning-help 0.0.1 Source cves: CVE-2024-8020 Source advisor...

moai-mdk (>=0.1.0a1, <=0.1.0a2) potentially affected by CVE-2024-8020 via pytorch-lightning (1.0.7)

pytorch-lightning PYPI version 1.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - moai-mdk =0.1.0a1, =0.1.0a2 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...