Executive brief
PyTorch Lightning, a popular framework for high-level machine learning development, is vulnerable to a security flaw that allows for arbitrary code execution. An attacker can create a specially crafted model checkpoint file that, when loaded by a user, executes malicious commands on the user's system. This vulnerability is particularly dangerous because it bypasses standard security protections designed to make loading machine learning models safe.
Technical details
A remote code execution vulnerability exists in PyTorch Lightning's `_load_state` function within `src/lightning/pytorch/core/saving.py`. The vulnerability stems from unsafe reflection (CWE-470) where the library reads a string field named `_instantiator` from a checkpoint's hyperparameters and uses it in an `__import__` and `getattr` call. Because this field consists of plain strings/dictionaries, it bypasses the `weights_only=True` security mitigation introduced in PyTorch to prevent pickle-based attacks. An attacker can achieve arbitrary code execution by tricking a user into calling `LightningModule.load_from_checkpoint` on a malicious checkpoint file. The issue is fixed in commit d710d68 by implementing an allowlist for trusted instantiators.
Affected products
- Lightning-AI pytorch-lightning <= 2.6.5
Timeline
- 2026-06-09: disclosed: Reported via email to vendor
- 2026-07-14: patched: Fix merged in PR 21832
- 2026-07-15: advisory: CVE published and NVD record created
References
- https://github.com/Lightning-AI/pytorch-lightning/commit/d710d689510d50e800f53b3cd773cbca20b1f86f
- https://github.com/Lightning-AI/pytorch-lightning/issues/21822
- https://github.com/Lightning-AI/pytorch-lightning/pull/21832
- https://www.vulncheck.com/advisories/pytorch-lightning-arbitrary-code-execution-via-instantiator-hyperparameter