Advisoriesby Ibispytorch-lightningGHSA-2vj5-px25-gjrp
pytorch-lightning is vulnerable to Deserialization of Untrusted Data
Fix: upgrade to 1.6.0 or later
pytorch-lightning is vulnerable to Deserialization of Untrusted Data.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| pytorch-lightning PyPI | < 1.6.0 | 1.6.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- CVE-2021-4118, PYSEC-2021-874, PYSEC-2026-3968
- nvd.nist.gov/vuln/detail/CVE-2021-4118
- github.com/PyTorchLightning/pytorch-lightning/issues/11045
- github.com/PyTorchLightning/pytorch-lightning/pull/11099
- github.com/pytorchlightning/pytorch-lightning/commit/62f1e82e032eb16565e676d39e0db0cac7e34ace
- github.com/PyTorchLightning/pytorch-lightning/releases/tag/1.6.0
- github.com/advisories/GHSA-2vj5-px25-gjrp
- github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2021-874.yaml
- github.com/pytorchlightning/pytorch-lightning
- huntr.dev/bounties/31832f0c-e5bb-4552-a12c-542f81f111e6
More pytorch-lightning advisories
All pytorch-lightning
pytorch-lightning: remote code executionCVE-2026-58659fixed in 2.6.6PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserializationCVE-2026-31221no fix yetCompromise of PyTorch Lightning PyPi Package VersionsCVE-2026-44484no fix yetPyTorch Lightning denial of service vulnerabilityCVE-2024-8020no fix yetPyTorch Lightning path traversal vulnerabilityCVE-2024-8019fixed in 2.4.0Code Injection in PyTorch LightningCVE-2022-0845fixed in 1.6.0