Advisoriesby Ibispytorch-lightningGHSA-r5qj-cvf9-p85h
Code Injection in PyTorch Lightning
Fix: upgrade to 1.6.0 or later
PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the PL_TRAINER_GPUS when using the Trainer module. A [patch](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) is included in the 1.6.0 release.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| pytorch-lightning PyPI | < 1.6.0 | 1.6.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2022-0845, PYSEC-2022-181, PYSEC-2026-3969
- nvd.nist.gov/vuln/detail/CVE-2022-0845
- github.com/PyTorchLightning/pytorch-lightning/pull/12212
- github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae
- github.com/advisories/GHSA-r5qj-cvf9-p85h
- github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2022-181.yaml
- github.com/pytorchlightning/pytorch-lightning
- huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a
More pytorch-lightning advisories
All pytorch-lightning
pytorch-lightning: remote code executionCVE-2026-58659fixed in 2.6.6PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserializationCVE-2026-31221no fix yetCompromise of PyTorch Lightning PyPi Package VersionsCVE-2026-44484no fix yetPyTorch Lightning denial of service vulnerabilityCVE-2024-8020no fix yetPyTorch Lightning path traversal vulnerabilityCVE-2024-8019fixed in 2.4.0pytorch-lightning is vulnerable to Deserialization of Untrusted DataCVE-2021-4118fixed in 1.6.0