CyberRota Analysis
AI-GeneratedA remote code execution vulnerability exists in PyTorch Lightning versions up to 2.6.5, allowing attackers to execute arbitrary code by crafting malicious checkpoint files that exploit the _load_state function. This vulnerability can bypass existing protections and poses a significant risk to applications using affected versions, particularly those that load checkpoint files from untrusted sources. Organizations utilizing PyTorch Lightning should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.
Related CVEs
Other vulnerabilities affecting the same vendor(s)