CriticalVulnerability
CVE-2026-44484: PyTorch Lightning embedded malicious code that harvests credentials
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-44484
- Published
- Record updated
- Affected
- pytorch-lightning = 2.6.2
- pytorch-lightning = 2.6.3
- Fixed in
- No fixed version was stated when the source was last read.
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
CVE-2026-44484 affects PyTorch Lightning, a deep learning framework for pretraining and finetuning AI models. The description states that versions 2.6.2 and 2.6.2 introduced functionality consistent with a credential harvesting mechanism, and GitHub, Inc. maps the weakness to CWE-506, Embedded Malicious Code, with a CVSS 4.0 base score of 9.3 (Critical).
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- pytorch-lightningPyPILLM dependency since 2025-11-05 · 6 tracked dependents
Related items
- InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
- MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog
- MediumCPython flaw exposes AI inference servers to sandbox escape attacksSimilar attack · CSO Online
- HighCVE-2026-88981: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0…Similar attack · NVD/CVE Database
- MediumBinance heist is stark example of AI governance gaps and basic security failuresSimilar attack · CSO Online