PyTorch Lightning 2.6.2 introduced code that can capture and transmit user credentials, effectively enabling credential harvesting. This weakness corresponds to CWE‑506 and CWE‑829. An attacker who can influence the installation of the compromised package or execute its code can obtain stored credentials, potentially compromising other services or data.

The vulnerable product is PyTorch Lightning 2.6.2, released by Lightning‑AI. Any system that installs or imports this version from PyPI is at risk.

The CVSS score of 9.3 indicates high severity. No EPSS score data is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or CI environments that install the compromised PyPI package or execute code that imports it. By controlling the package installation or execution flow, an attacker can trigger the credential harvesting functionality and extract sensitive credentials from the environment.