# CVE-2022-0845: PyTorch Lightning code injection via eval()

Source: https://junglewise.ai/threats/cve-2022-0845-code-injection-in-pytorch-lightning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-0845 · Severity: low · CVSS 3.1 · Published 2026-09-10

PyTorch Lightning, a machine learning framework built on PyTorch, uses unsafe eval() function to parse configuration data in versions prior to 1.6.0. An attacker who can control configuration inputs could execute arbitrary code during model training or deployment, potentially compromising the entire ML pipeline and accessing sensitive data.

Technologies: [lightning (PyPI)](https://junglewise.ai/threats/technologies/lightning), [pytorch-lightning (PyPI)](https://junglewise.ai/threats/technologies/pytorch-lightning). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-0845 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-0845 being exploited in the wild.

**How severe is CVE-2022-0845?** Low severity, with a CVSS score of 3.1, published 10 September 2026.

**Which products and versions are affected?** lightning (PyPI) GIT:introduced=0,fixed=8b7a12c52e52a06408e9231647839ddb4665e8ae|ECOSYSTEM:introduced=0,fixed=1.6.0; pytorch-lightning (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.0, GIT:introduced=0,fixed=8b7a12c52e52a06408e9231647839ddb4665e8ae|ECOSYSTEM:introduced=0,fixed=1.6.0; PyTorch Lightning Lightning 0.0.1 through 1.5.10.

**Is there a fix for CVE-2022-0845?** Yes. lightning (PyPI): upgrade to 1.6.0 or later; pytorch-lightning (PyPI): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-0845 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-0845?** Check whether you run lightning (PyPI), pytorch-lightning (PyPI) or PyTorch Lightning Lightning at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lightning (PyPI): upgrade to 1.6.0 or later

  ```sh
  pip install "lightning>=1.6.0"
  ```

- pytorch-lightning (PyPI): upgrade to 1.6.0 or later

  ```sh
  pip install "pytorch-lightning>=1.6.0"
  ```


## Technical details

The vulnerability exists in argument parsing logic that uses Python's eval() function instead of safe alternatives like ast.literal_eval(). This allows remote code execution when untrusted configuration data is processed. The fix (commit 8b7a12c) replaces eval() with ast.literal_eval() to restrict parsing to literal Python structures only.

## Affected products

- PyTorch Lightning Lightning 0.0.1 through 1.5.10

## Identifiers

- CVE-2022-0845
- GHSA-r5qj-cvf9-p85h
- PYSEC-2022-181
- PYSEC-2026-3969

## Timeline

- 2026-09-10: disclosed
- 2022: patched: Fixed in version 1.6.0

## References

- [https://huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a](https://huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a)
- [https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae)

## Related threats

- [PYSEC-2026-3968 - pytorch-lightning is vulnerable to Deserialization of Untrusted Data](https://junglewise.ai/threats/cve-2021-4118-pytorch-lightning-deserialization-of-untrusted-data)
- [PYSEC-2026-3971 - PyTorch Lightning denial of service vulnerability](https://junglewise.ai/threats/cve-2024-8020-pytorch-lightning-denial-of-service-vulnerability)
- [PYSEC-2026-3975 - pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint](https://junglewise.ai/threats/cve-2024-5980-pytorch-lightning-vulnerable-to-arbitrary-file-write-via-v1-runs)
- [PYSEC-2026-3974 - Remote code execution in pytorch lightning](https://junglewise.ai/threats/cve-2024-5452-remote-code-execution-in-pytorch-lightning)
- [PyTorch Lightning remote code execution in load_from_checkpoint](https://junglewise.ai/threats/cve-2026-58659-pytorch-lightning-remote-code-execution-in-load-from-checkpoint)