CVE-2026-31221
HighSummary
PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method calls torch.load() without setting the security-restrictive weights_only=True parameter, allowing deserialization of arbitrary Python objects.
Risk Assessment
A remote attacker can exploit this vulnerability by providing a maliciously crafted checkpoint file, leading to arbitrary code execution on the victim's system when the file is loaded.
Recommendation
It is recommended to update PyTorch-Lightning to version 2.6.1 or later to mitigate this vulnerability. Additionally, avoid loading checkpoints from untrusted sources.
Other vulnerabilities in PyTorch-Lightning
See all- CVE-2026-44484Critical
A vulnerability in PyTorch Lightning versions 2.6.2 and 2.6.2 introduces functionality consistent with credential harvesting.
- CVE-2026-58659High
A vulnerability in PyTorch Lightning up to version 2.6.5 (fixed in commit d710d68) allows remote code execution via the _load_state function, which imports and executes attacker-controlled module names from _instantiator hyperparameters in checkpoint files. Attackers can craft malicious checkpoint files that bypass weights_only=True protections and execute arbitrary code when LightningModule.load_from_checkpoint is called.
Original NVD description (English source)
PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to load saved model states, internally calls torch.load() without setting the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, leading to arbitrary code execution on the victim's system when the file is loaded.