pytorch-lightningGHSA-r5qj-cvf9-p85h
Code Injection in PyTorch Lightning
Critical9.8CVE-2022-0845 · Published Mar 6, 2022 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| pytorch-lightning PyPI | < 1.6.0 | 1.6.0 |
Details and references
PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the `PL_TRAINER_GPUS` when using the `Trainer` module. A [patch](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) is included in the `1.6.0` release.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2022-0845, PYSEC-2022-181, PYSEC-2026-3969
- nvd.nist.gov/vuln/detail/CVE-2022-0845
- github.com/PyTorchLightning/pytorch-lightning/pull/12212
- github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae
- github.com/advisories/GHSA-r5qj-cvf9-p85h
- github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2022-181.yaml
- github.com/pytorchlightning/pytorch-lightning
- huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a
More pytorch-lightning advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 62022 | pytorch-lightning is vulnerable to Deserialization of Untrusted Data CVE-2021-4118High7.8fixed in 1.6.0 | High7.8 | 1.6.0 |
| Mar 202025 | PyTorch Lightning path traversal vulnerability CVE-2024-8019Critical9.1fixed in 2.4.0 | Critical9.1 | 2.4.0 |
| Mar 202025 | PyTorch Lightning denial of service vulnerability CVE-2024-8020High7.5no fix yet | High7.5 | No fix yet |
| May 7 | Compromise of PyTorch Lightning PyPi Package Versions CVE-2026-44484Critical9.8no fix yet | Critical9.8 | No fix yet |
| May 12 | PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization CVE-2026-31221High7.8no fix yet | High7.8 | No fix yet |
| Jul 15 | PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass we CVE-2026-58659High7.8fixed in 2.6.6 | High7.8 | 2.6.6 |