{"data":{"id":"295ec02a-d37f-4b2f-8e9b-d9cff1fb55ae","title":"CVE-2026-58659: PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the…","summary":"CVE-2026-58659 affects PyTorch Lightning through 2.6.5, fixed in commit d710d68. The _load_state function imports and executes attacker-controlled module names taken from checkpoint _instantiator hyperparameters. A crafted checkpoint that bypasses weights_only=True can run arbitrary code when LightningModule.load_from_checkpoint is called.","solution":"Fixed in commit d710d68.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58659","publishedAt":"2026-07-15T18:16:48.743Z","cveId":"CVE-2026-58659","cweIds":["CWE-470"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["lightning@< 2.6.6 (fixed: 2.6.6)"],"affectedPackageNames":["lightning"],"affectedPackageRefs":["pypi:lightning"],"affectedVendors":[],"affectedVendorsRaw":["PyTorch Lightning"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"PyTorch Lightning remote code execution via checkpoint _instantiator","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00626,"epssCheckedAt":"2026-10-15T00:11:27.837Z","kevDateAdded":null,"advisoryAliases":["GHSA-qqmf-gpg7-g8gw"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:46:37.642Z","patchAvailable":true,"disclosureDate":"2026-07-15T18:16:48.743Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"]}}