EUVD-2026-29505
GHSA-75m9-98v2-hjpm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4Blast Radius
ecosystem impact- 5 pypi packages depend on pytorch-lightning (4 direct, 1 indirect)
Ecosystem-wide dependent count for version 2.6.0.
DescriptionCVE.org
PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to load saved model states, internally calls torch.load() without setting the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, leading to arbitrary code execution on the victim's system when the file is loaded.
AnalysisAI
Arbitrary code execution occurs in PyTorch Lightning 2.6.0 and earlier when loading malicious checkpoint files. The LightningModule.load_from_checkpoint() method deserializes untrusted Pickle data without security restrictions, allowing attackers to execute arbitrary Python code when victims open crafted .ckpt files. EPSS score of 0.06% (19th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis. Attack requires local access and user interaction (opening a malicious checkpoint), limiting remote attack scenarios to social engineering or supply chain compromise.
Technical ContextAI
PyTorch Lightning is a high-level PyTorch wrapper framework for organizing machine learning research code. The vulnerability stems from insecure deserialization (CWE-502) in the checkpoint persistence mechanism. Model checkpoints in PyTorch are typically serialized using Python's Pickle module, which can execute arbitrary code during deserialization. PyTorch introduced the weights_only=True parameter in torch.load() to restrict deserialization to tensors only, preventing code execution. However, PyTorch Lightning's load_from_checkpoint() wrapper method calls torch.load() with default parameters (weights_only=False), allowing full object deserialization. This design choice prioritizes backward compatibility over security, creating a code execution vector when loading untrusted checkpoint files.
RemediationAI
Upstream fix version not independently confirmed from available data - vendors should consult the official PyTorch Lightning GitHub repository and security advisories for patch availability. Until patched versions are deployed, implement these specific mitigations: (1) Modify code to use torch.load(checkpoint_path, weights_only=True) directly instead of load_from_checkpoint(), then manually instantiate the LightningModule - this breaks compatibility with checkpoints containing custom Python objects but eliminates code execution risk; (2) Implement cryptographic signature verification for all checkpoint files using HMAC-SHA256 or digital signatures before loading, rejecting unsigned or invalid files; (3) Restrict checkpoint loading to files from trusted internal sources only, blocking external downloads via network policies; (4) Run checkpoint loading operations in isolated containers or virtual machines with no network access and minimal privileges, treating all checkpoints as untrusted until validated. Trade-offs: weights_only=True breaks legitimate use cases requiring custom callbacks or objects in checkpoints; signature verification requires key management infrastructure; container isolation adds operational complexity. Organizations sharing models publicly should publish checksums/signatures alongside checkpoint files. Monitor PyTorch Lightning release notes at https://github.com/Lightning-AI/pytorch-lightning/releases for security patches.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today