CVE-2026-58659: PyTorch Lightning remote code execution in load_from_checkpoint

CVE-2026-58659 · Severity: high · CVSS 7.8 · Published 2026-07-15

PyTorch Lightning, a popular framework for high-level machine learning development, is vulnerable to a security flaw that allows for arbitrary code execution. An attacker can create a specially crafted model checkpoint file that, when loaded by a user, executes malicious commands on the user's system. This vulnerability is particularly dangerous because it bypasses standard security protections designed to make loading machine learning models safe.

Technologies: lightning (PyPI), pytorch-lightning (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-58659 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58659 being exploited in the wild.
How severe is CVE-2026-58659?
High severity, with a CVSS score of 7.8, published 15 July 2026.
Which products and versions are affected?
lightning (PyPI) < 2.6.6, ECOSYSTEM:introduced=0,fixed=2.6.6; pytorch-lightning (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.6.
Is there a fix for CVE-2026-58659?
Yes. lightning (PyPI): upgrade to 2.6.6 or later; pytorch-lightning (PyPI): upgrade to 2.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58659 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-58659?
Check whether you run lightning (PyPI) or pytorch-lightning (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lightning (PyPI): upgrade to 2.6.6 or later
    pip install "lightning>=2.6.6"
  • pytorch-lightning (PyPI): upgrade to 2.6.6 or later
    pip install "pytorch-lightning>=2.6.6"

Technical details

A remote code execution vulnerability exists in PyTorch Lightning's `_load_state` function within `src/lightning/pytorch/core/saving.py`. The vulnerability stems from unsafe reflection (CWE-470) where the library reads a string field named `_instantiator` from a checkpoint's hyperparameters and uses it in an `__import__` and `getattr` call. Because this field consists of plain strings/dictionaries, it bypasses the `weights_only=True` security mitigation introduced in PyTorch to prevent pickle-based attacks. An attacker can achieve arbitrary code execution by tricking a user into calling `LightningModule.load_from_checkpoint` on a malicious checkpoint file. The issue is fixed in commit d710d68 by implementing an allowlist for trusted instantiators.

Affected products

  • Lightning-AI pytorch-lightning <= 2.6.5

Identifiers

  • CVE-2026-58659
  • GHSA-qqmf-gpg7-g8gw
  • PYSEC-2026-3624
  • PYSEC-2026-3967

Timeline

  • 2026-06-09: disclosed: Reported via email to vendor
  • 2026-07-14: patched: Fix merged in PR 21832
  • 2026-07-15: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.