Skip to content
Threat Feed
Subscribe

Vendor

Lightning-AI

2 briefs RSS
high advisory

Remote Code Execution Vulnerability in PyTorch Lightning via Malicious Checkpoint Files (CVE-2026-58659)

A remote code execution vulnerability, CVE-2026-58659, exists in PyTorch Lightning through version 2.6.5, allowing attackers to craft malicious checkpoint files that execute arbitrary code by exploiting a flaw in the `_load_state` function when `LightningModule.load_from_checkpoint` is called.

PyTorch Lightning remote-code-execution vulnerability python pytorch
1t 1c 1i
critical advisory

Compromise of PyTorch Lightning PyPI Package Versions

Compromised PyTorch Lightning PyPI packages versions 2.6.2 and 2.6.3 contain malicious code related to credential harvesting, requiring immediate credential rotation and system rebuilding.

pytorch-lightning +1 supply-chain credential-theft pypi
2r 1t 1i