PyTorch Lightning CVE-2026-58659

Exploitation requires that a victim load an attacker-supplied checkpoint via LightningModule.load_from_checkpoint (the underlying _load_state path); specifically the malicious .ckpt must set hyper_parameters['_instantiator'] to an arbitrary importable path (the POC/test uses 'os.system'), which unpatched Lightning imports and executes. Critically, torch weights_only=True does NOT prevent it, because execution occurs in Lightning's own instantiator-resolution logic rather than in pickle. Limiting factors: the vector is local (AV:L) and requires active user interaction (UI:A) - the attacker cannot trigger it remotely and must convince the victim to obtain and load the crafted checkpoint; no authentication or special privileges are needed to craft the file (PR:N), and it works against default configurations of affected versions with no non-default feature required. Deployments that only ever load self-produced, trusted checkpoints are effectively not exposed.

The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H, base 8.4) correctly frames this as a local, low-complexity, unauthenticated flaw whose exploitation hinges on active user interaction - the victim must load an attacker-supplied checkpoint. No EPSS/exploitation-probability figure is supplied and there is no CISA KEV listing, so there is no evidence of active in-the-wild exploitation; however, publicly available exploit code exists and the patch's own test case (using os.system as the instantiator) shows exploitation is trivial once a malicious file is loaded. The realistic risk is high in ML supply-chain contexts where practitioners routinely download pretrained checkpoints from model hubs or shared storage and load them without provenance checks - a common habit this flaw weaponizes. It is not remotely exploitable against a service (AV:L, UI:A), so it is not a wormable or mass-exploitation network threat; it is a targeted social-engineering / supply-chain vector. The signals are consistent (local vector, high technical impact, POC available) with no conflicts, though the absence of an EPSS score means widespread automated-exploitation likelihood cannot be quantified from the input.

An attacker publishes an attractive pretrained model checkpoint (e.g., on a model-sharing hub or shared drive) whose hyper_parameters include _instantiator set to a dangerous import path such as os.system. When a data scientist runs LightningModule.load_from_checkpoint on the file - even with weights_only=True - Lightning imports and executes that path, running arbitrary code with the victim's privileges. A public POC demonstrating this via the _instantiator field exists.