Pytorch Lightning
Approved changes feed: RSS · Atom
cpe:2.3:a:lightning-ai:pytorch-lightning:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Lightning Ai (971c47f4-cecc-574a-989e-9e380a89a2a0) |
|---|---|
| Product | Pytorch Lightning (891371eb-12f5-53f8-a074-99b99b63ac0a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-58659 |
vulnerable | 2026-07-29 01:03:17.326768 |
PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter
HIGH (7.8)
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.
Published: 2026-07-15T17:02:40.640Z
Updated: 2026-07-18T01:03:17.592Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44484 |
vulnerable | 2026-06-08 08:05:11.109482 |
Compromise of PyTorch Lightning PyPi Package Versions
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
Published: 2026-05-14T14:59:03.933Z
Updated: 2026-07-15T00:53:59.223Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.