Veille CVE

Recherche « Lightningai pytorch lightning »

3 CVE

Critique 1 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Lightningai pytorch lightning » ✕
  1. CVE-2026-58659 7.8 Élevée

    Lightning-AI pytorch-lightning · Lightningai pytorch lightning

    PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.

  2. CVE-2026-44484 9.8 Critique

    Lightning-AI pytorch-lightning · Red Hat AI Inference Server · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)

    PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.

  3. CVE-2026-31221 7.8 Élevée

    Lightningai pytorch lightning

    PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to load saved model states, internally calls torch.load() without setting the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, leading to arbitrary code execution on the victim's system when the file is loaded.