ablation (0.1.0), acids-msprior (>=1.0.1, <=1.1.3) +495 more potentially affected by CVE-2024-8019 via pytorch-lightning (>=0.5.3.2, <=2.3.3)

pytorch-lightning PYPI version =0.5.3.2, =1.0.1, =2.1.16, =1.3.0, =1.8.15, =1.8.17, =1.8.14, =1.0.0rc1, =0.2.2, =0.1.1, =0.1.1, =0.6.1 and more Source cves: CVE-2024-8019 Source advisory: MEND:CVE-2024-8019...

CVE-2024-8019 Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

PyTorch security vulnerabilities

PyTorch is a Python package open-sourced by PyTorch. PyTorch has a security vulnerability that stems from the uploadresultstos3.sh script not ensuring S3 bucket ownership, which could lead to data disclosure or unauthorized access...

CVE-2024-6577: Undefined Security Weakness

In the latest version of pytorch/serve, the script 'uploadresultstos3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not...

PT-2025-12205

Name of the Vulnerable Software and Affected Versions pytorch-lightning version 2.3.2 Description A vulnerability in pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occu...

PT-2025-12204

Name of the Vulnerable Software and Affected Versions lightning-ai/pytorch-lightning version 2.3.2 Description A vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/upload file/ endpoint, allowing an attacker to write or overwrite...

Pytorch-Lightning code issues and vulnerabilities

Pytorch-Lightning is an open source lightweight PyTorch wrapper from Lightning AI open source in the US. Used for high performance Ai research. Pytorch-Lightning suffers from a code issue vulnerability that stems from the application's lack of effective validation of uploaded files. An attacker c...

CVE-2024-8019: Unrestricted Upload of File with Dangerous Type

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

Number withdrawal

PyTorch is a Python package in the PyTorch open source. This CVE number has been withdrawn...

PT-2025-12163

Name of the Vulnerable Software and Affected Versions pytorch/serve affected versions not specified Description The issue concerns the script 'upload results to s3.sh' referencing the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could...

CVE-2024-8020: Uncaught Exception

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

PT-2025-12194

Name of the Vulnerable Software and Affected Versions pytorch/pytorch versions =2.3.1 Description A deserialization vulnerability exists in the Pytorch RPC framework, allowing an attacker to execute arbitrary code remotely by sending a malicious serialized PythonUDF object. This flaw leads to...

CVE-2025-2149

A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnqSigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zeropoint leads to improper initialization. The attack needs to be approached...

CVE-2025-2148

A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler.callendcallbacksonjitfut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launch...

Arbitrary Code Execution (ACE)

PickleScan is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to PickleScan failing to detect malicious pickle files when specific ZIP file flag bits are modified, allowing attackers to embed harmful pickle files that remain unnoticed while still being loaded by PyTorch’s...

PyTorch Quantized Sigmoid Module Sigmoid Data Compromise

The vulnerability of the nnqSigmoid function in the Quantized Sigmoid Module of the PyTorch machine learning framework is related to incorrect initialization of resources when processing parameters scale and zeropoint. Exploiting this vulnerability can allow attackers to compromise the integrity ...

Zip Exploit Crashes Picklescan But Not PyTorch

Summary PickleScan is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise...

GHSA-7Q5R-7GVP-WC82 Zip Exploit Crashes Picklescan But Not PyTorch

Summary PickleScan is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise...

Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

Summary PickleScan fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2025-2149 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2025-2149 Source advisory: OSV:GHSA-X3GM-94WQ-G975...