CVE-2026-31221: PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoi

PyTorch-Lightning versions 2.6.0 and earlier have a vulnerability in their checkpoint loading function that allows attackers to execute arbitrary code (running any commands they want on a victim's computer) by providing a malicious checkpoint file. The problem occurs because the code uses torch.load() without the weights_only=True parameter, which means it can deserialize (reconstruct) any Python object, including dangerous ones hidden in the checkpoint file.