lightning
PyPI9 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting lightningpage 1 of 1
- CVE-2021-4118HIGHCVSS 7.8EG 7.8fixed in 1.6.02021-12-23
vulnerable: 0.0.2 ... 0.0.1 (142 versions)
pytorch-lightning is vulnerable to Deserialization of Untrusted Data
- CVE-2022-0845CRITICALCVSS 9.8EG 9.8fixed in 1.6.02022-03-05
vulnerable: 0.0.2 ... 0.0.1 (142 versions)
Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
- CVE-2024-5452CRITICALCVSS 9.8EG 9.8fixed in 2.3.32024-06-06
vulnerable: 1.8.0 ... 2.3.2 (68 versions)
A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The librar…
- CVE-2024-5980CRITICALCVSS 9.8EG 9.8fixed in 2.3.32024-06-27
vulnerable: 1.8.0 ... 2.3.2 (68 versions)
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy ma…
- CVE-2024-8019CRITICALCVSS 9.1EG 9.1fixed in 2.4.02025-03-20
vulnerable: 0.0.2 ... 2.4.0.dev20241020 (235 versions)
In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbit…
- CVE-2024-8020HIGHCVSS 7.5EG 7.52025-03-20
vulnerable: 0.0.2 ... 2.3.2 (217 versions)
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper hand…
- CVE-2026-31221HIGHCVSS 7.8EG 7.82026-05-12
vulnerable: 0.0.2 ... 2.6.0.dev20260125 (316 versions)
PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to load saved model sta…
- CVE-2026-44484CRITICALCVSS 9.8EG 9.8fixed in 2.6.42026-05-14
vulnerable: 2.6.2, 2.6.3
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
- CVE-2026-58659HIGHCVSS 7.8EG 7.8fixed in 2.6.62026-07-15
vulnerable: 1.8.0 ... 2.6.5 (171 versions)
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. …
Check whether lightning is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for lightning CVEs against the assets you own.
Book a Demo →