pytorch_lightning-2.6.5-py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.8)

[mend-for-github-com]

Vulnerable Library - pytorch_lightning-2.6.5-py3-none-any.whl

PyTorch Lightning is the lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.

Library home page: https://files.pythonhosted.org/packages/8b/4d/5740c27110b83634d8491c3b5facf0111b3e554c3164f4fb953be9bddaf6/pytorch_lightning-2.6.5-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260715123531_ZECXAJ/python_NWETVX/202607151235321/env/lib/python3.10/site-packages/pytorch_lightning-2.6.5.dist-info

Found in HEAD commit: c5914a21ae954deee909aaaafbb8ad722da7ffa9

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (pytorch_lightning version)	Remediation Possible**	Reachability
CVE-2026-58659	High	7.8	pytorch_lightning-2.6.5-py3-none-any.whl	Direct	N/A	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-58659

Vulnerable Library - pytorch_lightning-2.6.5-py3-none-any.whl

PyTorch Lightning is the lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.

Library home page: https://files.pythonhosted.org/packages/8b/4d/5740c27110b83634d8491c3b5facf0111b3e554c3164f4fb953be9bddaf6/pytorch_lightning-2.6.5-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260715123531_ZECXAJ/python_NWETVX/202607151235321/env/lib/python3.10/site-packages/pytorch_lightning-2.6.5.dist-info

Dependency Hierarchy:

• ❌ pytorch_lightning-2.6.5-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: c5914a21ae954deee909aaaafbb8ad722da7ffa9

Found in base branch: master

Vulnerability Details

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.

Publish Date: 2026-07-15

URL: CVE-2026-58659

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.