An insecure deserialization flaw in PyTorch-Lightning versions 2.6.0 and earlier allows a malicious checkpoint file to be loaded without the safety guard weight_only=True. The deserialization of arbitrary Python objects via Pickle gives an attacker the ability to execute arbitrary code during the load_from_checkpoint() process, compromising confidentiality, integrity, and availability of the target system.

The vulnerability affects PyTorch-Lightning packages released up to and including version 2.6.0. Users of these versions that load checkpoints from external sources are at risk.

The CVSS score is 8.8, indicating a high severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that a remote attacker supplies a maliciously crafted checkpoint file, which the victim then loads. If the attacker can influence the checkpoint loading step, arbitrary code execution can be achieved. The exploitation requires the victim to run code that loads the deserialized object, which is common in model deployment pipelines.