Is CVE-2022-0845 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-0845 being exploited in the wild.

How severe is CVE-2022-0845?

Low severity, with a CVSS score of 3.1, published 10 September 2026.

Which products and versions are affected?

lightning (PyPI) GIT:introduced=0,fixed=8b7a12c52e52a06408e9231647839ddb4665e8ae|ECOSYSTEM:introduced=0,fixed=1.6.0; pytorch-lightning (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.0, GIT:introduced=0,fixed=8b7a12c52e52a06408e9231647839ddb4665e8ae|ECOSYSTEM:introduced=0,fixed=1.6.0; PyTorch Lightning Lightning 0.0.1 through 1.5.10.

Is there a fix for CVE-2022-0845?

Yes. lightning (PyPI): upgrade to 1.6.0 or later; pytorch-lightning (PyPI): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-0845 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-0845?

Check whether you run lightning (PyPI), pytorch-lightning (PyPI) or PyTorch Lightning Lightning at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0845: PyTorch Lightning code injection via eval()

CVE-2022-0845 · Severity: low · CVSS 3.1 · Published 2026-09-10

PyTorch Lightning, a machine learning framework built on PyTorch, uses unsafe eval() function to parse configuration data in versions prior to 1.6.0. An attacker who can control configuration inputs could execute arbitrary code during model training or deployment, potentially compromising the entire ML pipeline and accessing sensitive data.

Technologies: lightning (PyPI), pytorch-lightning (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-0845 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-0845 being exploited in the wild.
How severe is CVE-2022-0845?: Low severity, with a CVSS score of 3.1, published 10 September 2026.
Which products and versions are affected?: lightning (PyPI) GIT:introduced=0,fixed=8b7a12c52e52a06408e9231647839ddb4665e8ae|ECOSYSTEM:introduced=0,fixed=1.6.0; pytorch-lightning (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.0, GIT:introduced=0,fixed=8b7a12c52e52a06408e9231647839ddb4665e8ae|ECOSYSTEM:introduced=0,fixed=1.6.0; PyTorch Lightning Lightning 0.0.1 through 1.5.10.
Is there a fix for CVE-2022-0845?: Yes. lightning (PyPI): upgrade to 1.6.0 or later; pytorch-lightning (PyPI): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0845 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-0845?: Check whether you run lightning (PyPI), pytorch-lightning (PyPI) or PyTorch Lightning Lightning at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lightning (PyPI): upgrade to 1.6.0 or later
```
pip install "lightning>=1.6.0"
```
pytorch-lightning (PyPI): upgrade to 1.6.0 or later
```
pip install "pytorch-lightning>=1.6.0"
```

Technical details

The vulnerability exists in argument parsing logic that uses Python's eval() function instead of safe alternatives like ast.literal_eval(). This allows remote code execution when untrusted configuration data is processed. The fix (commit 8b7a12c) replaces eval() with ast.literal_eval() to restrict parsing to literal Python structures only.

Affected products

PyTorch Lightning Lightning 0.0.1 through 1.5.10

Identifiers

CVE-2022-0845
GHSA-r5qj-cvf9-p85h
PYSEC-2022-181
PYSEC-2026-3969

Timeline

2026-09-10: disclosed
2022: patched: Fixed in version 1.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.