EUVD-2026-29505
GHSA-75m9-98v2-hjpm
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 4 pypi packages depend on pytorch-lightning (3 direct, 1 indirect)
Ecosystem-wide dependent count for version 2.6.0.
DescriptionNVD
PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to load saved model states, internally calls torch.load() without setting the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, leading to arbitrary code execution on the victim's system when the file is loaded.
AnalysisAI
Arbitrary code execution occurs in PyTorch Lightning 2.6.0 and earlier when loading malicious checkpoint files. The LightningModule.load_from_checkpoint() method deserializes untrusted Pickle data without security restrictions, allowing attackers to execute arbitrary Python code when victims open crafted .ckpt files. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all PyTorch Lightning installations (versions ≤2.6.0) across data science, ML ops, and research environments using software inventory tools; restrict access to checkpoint files from untrusted sources and implement file scanning policies. Within 7 days: Establish a policy requiring security review before loading checkpoints from external sources, and document approved checkpoint sources; monitor for vendor patch releases. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today