CVE-2026-58659 — PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlle…
Published: 2026-07-15 · CVSS: 8.4 · CVSS 4.0
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7