# lightning (PyPI) vulnerabilities 9 known vulnerabilities (4 critical, 5 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.6.6 (Sep 10, 2026): no advisory affects it - Newest unaffected release: 2.6.6 (Sep 10, 2026), the latest release - Weekly downloads: 1.2M - Dependents: 990 - Releases: 172 since 1.8.0 (Nov 1, 2022) - Registry: https://pypi.org/project/lightning/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-58659: 1.8.0rc1 to 2.6.5 (2.6.6 is outside it) - CVE-2026-44484: no published release is affected - CVE-2026-31221: 1.8.0rc1 to 2.6.0 (2.6.1.dev20260201 is outside it) - CVE-2024-8020: 1.8.0rc1 to 2.3.2 (2.3.3 is outside it) - CVE-2024-8019: 1.8.0rc1 to 2.4.0.dev20241020 (2.4.0 is outside it) - CVE-2024-5980: 1.8.0rc1 to 2.3.2 (2.3.3 is outside it) - CVE-2024-5452: 1.8.0rc1 to 2.3.2 (2.3.3 is outside it) - CVE-2022-0845: no published release is affected - CVE-2021-4118: no published release is affected ## Advisories (9) ### [CVE-2026-58659](https://cve.now/CVE-2026-58659): PyTorch Lightning Arbitrary Code Execution via \_instantiator Hyperparameter - Severity: High 8.4 - Published: Jul 15, 2026 - Affected: fixed in 2.6.6. - Fixed in 2.6.6 (released Sep 10, 2026, 57 days after disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2026-44484](https://cve.now/CVE-2026-44484): Compromise of PyTorch Lightning PyPi Package Versions - Severity: Critical 9.3 - Published: May 14, 2026 - Affected: from 2.6.2, fixed in 2.6.4. - Fixed in 2.6.4 (released May 20, 2026, 6 days after disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2026-31221](https://cve.now/CVE-2026-31221): PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading… - Severity: High 8.8 - Published: May 12, 2026 - Affected: through 2.6.0. - Fixed in 2.6.1 (released Jan 30, 2026, 102 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.6.6, is not affected. ### [CVE-2024-8020](https://cve.now/CVE-2024-8020): Denial of Service in lightning-ai/pytorch-lightning - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: through 2.3.2. - Fixed in 2.3.3 (released Jul 8, 2024, 255 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.6.6, is not affected. ### [CVE-2024-8019](https://cve.now/CVE-2024-8019): Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning - Severity: Critical 9.1 - Published: Mar 20, 2025 - Affected: fixed in 2.4.0. - Fixed in 2.4.0 (released Aug 7, 2024, 225 days before disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2024-5980](https://cve.now/CVE-2024-5980): Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning - Severity: Critical 9.1 - Published: Jun 27, 2024 - Affected: fixed in 2.3.3. - Fixed in 2.3.3 (released Jul 8, 2024, 11 days after disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2024-5452](https://cve.now/CVE-2024-5452): RCE via Property/Class Pollution in lightning-ai/pytorch-lightning - Severity: Critical 9.8 - Published: Jun 6, 2024 - Affected: fixed in 2.3.3. - Fixed in 2.3.3 (released Jul 8, 2024, 32 days after disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2022-0845](https://cve.now/CVE-2022-0845): Code Injection in pytorchlightning/pytorch-lightning - Severity: High 7.3 - Published: Mar 5, 2022 - Affected: fixed in 1.6.0. - Fixed in 1.8.0 (released Nov 1, 2022, 241 days after disclosure, the advisory names 1.6.0, which was never published). - The latest release, 2.6.6, is not affected. ### [CVE-2021-4118](https://cve.now/CVE-2021-4118): Deserialization of Untrusted Data in pytorchlightning/pytorch-lightning - Severity: High 7.8 - Published: Dec 23, 2021 - Affected: fixed in 1.6.0. - Fixed in 1.8.0 (released Nov 1, 2022, 313 days after disclosure, the advisory names 1.6.0, which was never published). - The latest release, 2.6.6, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/lightning Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.