Technical impact
PyTorch Lightning prior to version 2.6.5 contains a flaw in its checkpoint loading logic where attacker‑controlled module names in the _instantiator hyperparameters can be imported and executed. This defect permits the execution of arbitrary code whenever LightningModule.load_from_checkpoint is invoked, effectively allowing a malicious user to run arbitrary payloads on a system that loads the compromised checkpoint. The weakness is related to unsafe code execution and improper deserialization of untrusted data.
Affected Systems
The vulnerability affects PyTorch Lightning implementations provided by Lightning‑AI, specifically all releases up to and including 2.6.5. The fix was introduced in commit d710d68, which is included in releases beyond that point (e.g., 2.6.6 and later). No other versions or vendors are listed as affected.
Risk and Exploitability
The severity is reflected in a CVSS score of 8.4, indicating high impact if exploited. The EPSS score is below 1%, suggesting a low probability of active exploitation currently, and the issue is not catalogued in CISA’s KEV list. Attackers likely need to deliver or otherwise provide a malicious checkpoint file to a processing node that calls load_from_checkpoint; the attack could be local or remote depending on how checkpoints are sourced. Because the flaw enables arbitrary module imports, successful exploitation would give attackers full control over the executing environment.
Github GHSA