EUVD-2026-44751
GHSA-qqmf-gpg7-g8gw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local because a checkpoint file must be loaded (AV:L) with required victim interaction (UI:R); crafting the file needs no attacker privileges (PR:N), and code execution yields full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.
AnalysisAI
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious checkpoint file to execute arbitrary code. The flaw lives in the _load_state routine, which imports and calls the module path named in a checkpoint's _instantiator hyperparameter, letting a crafted .ckpt bypass torch's weights_only=True safeguard when LightningModule.load_from_checkpoint is invoked. Reported by VulnCheck, it is fixed in commit d710d68 (PR #21832) via an instantiator allowlist, and publicly available exploit code exists though it is not listed in CISA KEV.
Technical ContextAI
PyTorch Lightning is a widely used high-level training framework layered on top of PyTorch. Checkpoints are Python objects serialized with torch.save; recent PyTorch versions added weights_only=True to torch.load to block the classic pickle-based code-execution path during deserialization. This vulnerability is a distinct, application-level bypass: Lightning stores an _instantiator hyperparameter (an import path string) inside the checkpoint's hyper_parameters, and _load_state in src/lightning/pytorch/core/saving.py dynamically imports and invokes whatever module path that string names. This is a textbook CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / unsafe reflection) issue - trusted control flow is driven by attacker-controlled data, so weights_only=True offers no protection because the dangerous import happens in Lightning's own logic after load, not inside pickle. The affected package is cpe:2.3:a:lightning-ai:pytorch-lightning.
RemediationAI
Upgrade to a PyTorch Lightning build containing fix commit d710d689510d50e800f53b3cd773cbca20b1f86f (PR #21832), which restricts the checkpoint _instantiator hyperparameter to an allowlist (_ALLOWED_INSTANTIATORS = lightning.pytorch.cli.instantiate_module and pytorch_lightning.cli.instantiate_module) and raises a ValueError on any other path; the upstream fix is confirmed, but a specific tagged/PyPI release version is not stated in the provided data, so verify the fixed version against the vendor advisory (https://www.vulncheck.com/advisories/pytorch-lightning-arbitrary-code-execution-via-instantiator-hyperparameter) before pinning. Until patched, only load checkpoints from trusted, provenance-verified sources and never load third-party or user-uploaded .ckpt files, since weights_only=True does NOT mitigate this bug; as a compensating control, inspect a checkpoint's hyper_parameters['_instantiator'] value before loading and reject anything that is not an lightning.pytorch.cli / pytorch_lightning.cli instantiate_module path, or run load_from_checkpoint inside a sandboxed, network-isolated, least-privilege process so any code execution is contained. The trade-off of restricting to trusted checkpoints is operational friction in workflows that consume community models, and manual _instantiator inspection is error-prone compared with upgrading.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Arbitrary code execution via torch-checkpoint-shrink.py script in ml-engineering project allows remote attackers to exec
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today