Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

lightning

9 known vulnerabilities (4 critical, 5 high), with the versions each affects and the releases that fix them.

Latest release
2.6.6 (Sep 10, 2026): no advisory affects it
Newest unaffected release
2.6.6 (Sep 10, 2026), the latest release
Advisories
9 · 4 critical, 5 high
Weekly downloads
1.2M
Dependents
990
Releases
172 since 1.8.0 (Nov 1, 2022)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-58659
    Affects 1.8.0rc1 to 2.6.5 (2.6.6 is outside it)
  • CVE-2026-44484
    No published release is affected
    No published release is affected
  • CVE-2026-31221
    Affects 1.8.0rc1 to 2.6.0 (2.6.1.dev20260201 is outside it)
  • CVE-2024-8020
    Affects 1.8.0rc1 to 2.3.2 (2.3.3 is outside it)
  • CVE-2024-8019
    Affects 1.8.0rc1 to 2.4.0.dev20241020 (2.4.0 is outside it)
  • CVE-2024-5980
    Affects 1.8.0rc1 to 2.3.2 (2.3.3 is outside it)
  • CVE-2024-5452
    Affects 1.8.0rc1 to 2.3.2 (2.3.3 is outside it)
  • CVE-2022-0845
    No published release is affected
    No published release is affected
  • CVE-2021-4118
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

  • PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter

    Affected: fixed in 2.6.6.

    Fixed in 2.6.6 (released Sep 10, 2026, 57 days after disclosure).

    The latest release, 2.6.6, is not affected.

  • CVE-2026-44484Critical 9.3

    Compromise of PyTorch Lightning PyPi Package Versions

    Affected: from 2.6.2, fixed in 2.6.4.

    Fixed in 2.6.4 (released May 20, 2026, 6 days after disclosure).

    The latest release, 2.6.6, is not affected.

  • PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading…

    Affected: through 2.6.0.

    Fixed in 2.6.1 (released Jan 30, 2026, 102 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 2.6.6, is not affected.

  • Denial of Service in lightning-ai/pytorch-lightning

    Affected: through 2.3.2.

    Fixed in 2.3.3 (released Jul 8, 2024, 255 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 2.6.6, is not affected.

  • CVE-2024-8019Critical 9.1

    Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning

    Affected: fixed in 2.4.0.

    Fixed in 2.4.0 (released Aug 7, 2024, 225 days before disclosure).

    The latest release, 2.6.6, is not affected.

  • CVE-2024-5980Critical 9.1

    Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning

    Affected: fixed in 2.3.3.

    Fixed in 2.3.3 (released Jul 8, 2024, 11 days after disclosure).

    The latest release, 2.6.6, is not affected.

  • CVE-2024-5452Critical 9.8

    RCE via Property/Class Pollution in lightning-ai/pytorch-lightning

    Affected: fixed in 2.3.3.

    Fixed in 2.3.3 (released Jul 8, 2024, 32 days after disclosure).

    The latest release, 2.6.6, is not affected.

  • Code Injection in pytorchlightning/pytorch-lightning

    Affected: fixed in 1.6.0.

    Fixed in 1.8.0 (released Nov 1, 2022, 241 days after disclosure, the advisory names 1.6.0, which was never published).

    The latest release, 2.6.6, is not affected.

  • Deserialization of Untrusted Data in pytorchlightning/pytorch-lightning

    Affected: fixed in 1.6.0.

    Fixed in 1.8.0 (released Nov 1, 2022, 313 days after disclosure, the advisory names 1.6.0, which was never published).

    The latest release, 2.6.6, is not affected.