CVE-2026-58659

Katalog CVE

CVSS 7.8 · High EPSS 0,63%

Kerentanan Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') pada lightningai pytorch lightning. Skor CVSS 3.1 7.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Lightning-AI/pytorch-lightning/commit/d710d689510d50e800f53b3cd773cbca20b1f86f patch
• https://github.com/Lightning-AI/pytorch-lightning/pull/21832 issue tracking · patch
• https://www.vulncheck.com/advisories/pytorch-lightning-arbitrary-code-execution-via-instantiator-hyperparamete... exploit · patch · advisory pihak ketiga
• https://github.com/Lightning-AI/pytorch-lightning/issues/21822 exploit · issue tracking · mitigasi