Vulnerabilities for lightning

First version without a known vulnerability: 2.6.6

Details

• PYSEC-2026-39722026-09-10

  PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

• PYSEC-2026-39732026-09-10

  Compromise of PyTorch Lightning PyPi Package Versions

  Fixed in: 2.6.4

• PYSEC-2026-39682026-09-10

  pytorch-lightning is vulnerable to Deserialization of Untrusted Data

  Fixed in: 62f1e82e032eb16565e676d39e0db0cac7e34ace, 1.6.0

• PYSEC-2026-39712026-09-10

  PyTorch Lightning denial of service vulnerability

• PYSEC-2026-39692026-09-10

  Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.

  Fixed in: 8b7a12c52e52a06408e9231647839ddb4665e8ae, 1.6.0

• PYSEC-2026-39702026-09-10

  PyTorch Lightning path traversal vulnerability

  Fixed in: 2.4.0

• GHSA-qqmf-gpg7-g8gw2026-07-15

  PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters

  Fixed in: 2022.6.15, 2.6.6

• MAL-2026-32012026-04-30

  Malicious code in lightning (PyPI)

• GHSA-mr7h-w2qc-ffc22024-06-27

  pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

  Fixed in: 2.3.3

• GHSA-cgwc-qvrx-rf7f2024-06-06

  Remote code execution in pytorch lightning

  Fixed in: 2.3.3