Description
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Lightning-AI | pytorch-lightning | ≤ 2.6.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | lightning | < 2.6.6 | 2.6.6 | GHSA-qqmf-gpg7-g8gw |
| PyPI | pytorch-lightning | < 2.6.6 | 2.6.6 | PYSEC-2026-3967 |
References
- Researcher Disclosure technical-description exploit issue-tracking
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/pytorch-lightning-arbitrary-code-execution-via-instantiator-hyperparameter third-party-advisory