PyPIPackage

pytorch-lightning

9 known vulnerabilities (4 critical, 5 high), with the versions each affects and the releases that fix them.

Latest release: 2.6.6 (Sep 10, 2026): no advisory affects it
Newest unaffected release: 2.6.6 (Sep 10, 2026), the latest release
Advisories: 9 · 4 critical, 5 high

Weekly downloads: 2.7M
Dependents: 1,751
Releases: 223 since 0.0.2 (Mar 31, 2019)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-58659
Affects 0.0.2 to 2.6.5 (2.6.6 is outside it)
CVE-2026-44484
No published release is affected
No published release is affected
CVE-2026-31221
Affects 0.0.2 to 2.6.0 (2.6.1 is outside it)
CVE-2024-8020
Affects 0.0.2 to 2.3.2 (2.3.3 is outside it)
CVE-2024-8019
Affects 0.0.2 to 2.3.3 (2.4.0 is outside it)
CVE-2024-5980
Affects 0.0.2 to 2.3.2 (2.3.3 is outside it)
CVE-2024-5452
Affects 0.0.2 to 2.3.2 (2.3.3 is outside it)
CVE-2022-0845
Affects 0.0.2 to 1.6.0rc1 (1.6.0 is outside it)
CVE-2021-4118
Affects 0.0.2 to 1.6.0rc1 (1.6.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-58659High 8.4
PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter
Affected: fixed in 2.6.6.
Fixed in 2.6.6 (released Sep 10, 2026, 57 days after disclosure).
The latest release, 2.6.6, is not affected.
CVE-2026-44484Critical 9.3
Compromise of PyTorch Lightning PyPi Package Versions
Affected: from 2.6.2, fixed in 2.6.4; versions 2.6.2; versions 2.6.3.
Fixed in 2.6.4 (released May 20, 2026, 6 days after disclosure).
The latest release, 2.6.6, is not affected.
CVE-2026-31221High 8.8
PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading…
Affected: through 2.6.0.
Fixed in 2.6.1 (released Jan 30, 2026, 102 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.6.6, is not affected.
CVE-2024-8020High 7.5
Denial of Service in lightning-ai/pytorch-lightning
Affected: through 2.3.2.
Fixed in 2.3.3 (released Jul 8, 2024, 255 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.6.6, is not affected.
CVE-2024-8019Critical 9.1
Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning
Affected: fixed in 2.4.0.
Fixed in 2.4.0 (released Aug 7, 2024, 225 days before disclosure).
The latest release, 2.6.6, is not affected.
CVE-2024-5980Critical 9.1
Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning
Affected: fixed in 2.3.3.
Fixed in 2.3.3 (released Jul 8, 2024, 11 days after disclosure).
The latest release, 2.6.6, is not affected.
CVE-2024-5452Critical 9.8
RCE via Property/Class Pollution in lightning-ai/pytorch-lightning
Affected: fixed in 2.3.3.
Fixed in 2.3.3 (released Jul 8, 2024, 32 days after disclosure).
The latest release, 2.6.6, is not affected.
CVE-2022-0845High 7.3
Code Injection in pytorchlightning/pytorch-lightning
Affected: fixed in 1.6.0; fixed in 1.6.0.
Fixed in 1.6.0 (released Mar 29, 2022, 24 days after disclosure).
The latest release, 2.6.6, is not affected.
CVE-2021-4118High 7.8
Deserialization of Untrusted Data in pytorchlightning/pytorch-lightning
Affected: fixed in 1.6.0; fixed in 1.6.0.
Fixed in 1.6.0 (released Mar 29, 2022, 96 days after disclosure).
The latest release, 2.6.6, is not affected.