Lightningai
Lightningai Pytorch Lightning: vulnerabilidades y CVE
Lightningai Pytorch Lightning tiene 9 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE9
Últimos 12 meses3
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-58659 | Alta (8.4) | 0.63% | — | 15 jul 2026 | PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint… |
| CVE-2026-44484 | Crítica (9.3) | 0.67% | — | 14 may 2026 | PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism. |
| CVE-2026-31221 | Alta (7.8) | 0.55% | — | 12 may 2026 | PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to… |
| CVE-2024-8020 | Alta (7.5) | 0.63% | — | 20 mar 2025 | A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs… |
| CVE-2024-8019 | Crítica (9.1) | 1.1% | — | 20 mar 2025 | In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to… |
| CVE-2024-5980 | Crítica (9.8) | 1.3% | — | 27 jun 2024 | A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server,… |
| CVE-2024-5452 | Crítica (9.8) | 27% | — | 6 jun 2024 | A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff`… |
| CVE-2022-0845 | Crítica (9.8) | 1.00% | — | 5 mar 2022 | Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0. |
| CVE-2021-4118 | Alta (7.8) | 0.98% | — | 23 dic 2021 | pytorch-lightning is vulnerable to Deserialization of Untrusted Data |