lightning (PyPI)

Known vulnerabilities and malicious package reports for lightning on PyPI, live from OSV, with CISA KEV exploitation status and EPSS scores.

Known package reports

1 malicious package report and 9 vulnerabilities returned by OSV. Check a specific version to see which reports apply.

If you installed a reported malicious release, remove it and rotate the credentials that machine could access. Upgrading does not undo code that already ran.

MAL-2026-3201: Malicious package report

Malicious code in lightning (PyPI)

Published 2026-04-30.

Updated 2026-06-08.

Reported affected releases: 2.6.2, 2.6.3.

GHSA-cgwc-qvrx-rf7f: Vulnerability

Remote code execution in pytorch lightning

Published 2024-06-06.

Updated 2026-09-10.

Affected ranges: introduced 0, fixed 2.3.3.

Fix versions reported by the advisory: 2.3.3.

Severity: CRITICAL.

CVE-2024-5452

GHSA-mr7h-w2qc-ffc2: Vulnerability

pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

Published 2024-06-27.

Updated 2026-09-10.

Affected ranges: introduced 0, fixed 2.3.3.

Fix versions reported by the advisory: 2.3.3.

Severity: CRITICAL.

CVE-2024-5980

PYSEC-2026-3970: Vulnerability

PyTorch Lightning path traversal vulnerability

Published 2026-09-10.

Updated 2026-09-10.

Affected ranges: introduced 0, fixed 2.4.0.

Fix versions reported by the advisory: 2.4.0.

Severity: CRITICAL.

CVE-2024-8019

PYSEC-2026-3968: Vulnerability

pytorch-lightning is vulnerable to Deserialization of Untrusted Data

Published 2026-09-10.

Updated 2026-09-10.

Affected ranges: introduced 0, fixed 62f1e82e032eb16565e676d39e0db0cac7e34ace; introduced 0, fixed 1.6.0.

Fix versions reported by the advisory: 62f1e82e032eb16565e676d39e0db0cac7e34ace, 1.6.0.

Severity: HIGH.

CVE-2021-4118

PYSEC-2026-3969: Vulnerability

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.

Published 2026-09-10.

Updated 2026-09-10.

Affected ranges: introduced 0, fixed 8b7a12c52e52a06408e9231647839ddb4665e8ae; introduced 0, fixed 1.6.0.

Fix versions reported by the advisory: 8b7a12c52e52a06408e9231647839ddb4665e8ae, 1.6.0.

Severity: CRITICAL.

CVE-2022-0845

PYSEC-2026-3973: Vulnerability

Compromise of PyTorch Lightning PyPi Package Versions

Published 2026-09-10.

Updated 2026-09-10.

Reported affected releases: 2.6.2, 2.6.3.

Affected ranges: introduced 2.6.2, fixed 2.6.4.

Fix versions reported by the advisory: 2.6.4.

Severity: CRITICAL.

CVE-2026-44484

PYSEC-2026-3971: Vulnerability

PyTorch Lightning denial of service vulnerability

Published 2026-09-10.

Updated 2026-09-10.

Affected ranges: introduced 0, last_affected 2.3.2.

Severity: HIGH.

CVE-2024-8020

GHSA-qqmf-gpg7-g8gw: Vulnerability

PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters

Published 2026-07-15.

Updated 2026-09-24.

Affected ranges: introduced 0, fixed 2.6.6.

Fix versions reported by the advisory: 2.6.6.

Severity: HIGH.

CVE-2026-58659

PYSEC-2026-3972: Vulnerability

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

Published 2026-09-10.

Updated 2026-09-10.

Affected ranges: introduced 0, last_affected 2.6.0.

Severity: HIGH.

CVE-2026-31221

Source: OSV, including OpenSSF malicious-package reports and GitHub advisories. No known report is not proof a package is safe.