CVE-2021-4118: PYSEC-2026-3968 - pytorch-lightning is vulnerable to Deserialization of Untrusted Data

CVE-2021-4118 · Severity: low · CVSS 3.1 · Published 2026-09-10

PyTorch Lightning is a popular machine learning framework used to simplify deep learning model training. The framework deserializes untrusted data without proper validation, allowing an attacker to execute arbitrary code when loading a malicious checkpoint file. This could lead to complete compromise of the training environment and access to sensitive model data.

Technologies: lightning (PyPI), pytorch-lightning (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-4118 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-4118 being exploited in the wild.
How severe is CVE-2021-4118?
Low severity, with a CVSS score of 3.1, published 10 September 2026.
Which products and versions are affected?
lightning (PyPI) GIT:introduced=0,fixed=62f1e82e032eb16565e676d39e0db0cac7e34ace|ECOSYSTEM:introduced=0,fixed=1.6.0; pytorch-lightning (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.0, GIT:introduced=0,fixed=62f1e82e032eb16565e676d39e0db0cac7e34ace|ECOSYSTEM:introduced=0,fixed=1.6.0.
Is there a fix for CVE-2021-4118?
Yes. lightning (PyPI): upgrade to 1.6.0 or later; pytorch-lightning (PyPI): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-4118 attacked?
It is attacked with local access.
Am I affected by CVE-2021-4118?
Check whether you run lightning (PyPI) or pytorch-lightning (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lightning (PyPI): upgrade to 1.6.0 or later
    pip install "lightning>=1.6.0"
  • pytorch-lightning (PyPI): upgrade to 1.6.0 or later
    pip install "pytorch-lightning>=1.6.0"

Technical details

PyTorch Lightning is vulnerable to unsafe deserialization of untrusted data (CWE-502). The vulnerability exists in checkpoint loading functionality, where the framework uses Python's pickle deserialization on user-supplied model checkpoint files without sufficient validation. An attacker can craft a malicious checkpoint file that executes arbitrary Python code during the unpickling process. The attack requires local file system access or the ability to trick a user into loading a malicious checkpoint; no network access or authentication is required. Exploitation results in arbitrary code execution with the privileges of the user running the training process. The vulnerability was fixed in version 1.6.0.

Affected products

  • PyTorch Lightning Lightning before 1.6.0

Identifiers

  • CVE-2021-4118
  • GHSA-2vj5-px25-gjrp
  • PYSEC-2021-874
  • PYSEC-2026-3968

Timeline

  • 2021-12-23: disclosed
  • 2022-01-06: advisory
  • 2022-01-06: patched: Version 1.6.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.