Executive brief
pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint
Affected products
- PyPI lightning
- PyPI pytorch-lightning
Junglewise Threat Intelligence
CVE-2024-5980: PYSEC-2026-3975 - pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint
CVE-2024-5980 · Severity: low · CVSS 3 · Published 2026-09-10
Technologies: lightning (PyPI), pytorch-lightning (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3968 - pytorch-lightning is vulnerable to Deserialization of Untrusted Data
- PYSEC-2026-3971 - PyTorch Lightning denial of service vulnerability
- PyTorch Lightning code injection via eval()
- PYSEC-2026-3974 - Remote code execution in pytorch lightning
- PyTorch Lightning remote code execution in load_from_checkpoint