# pytorch-lightning (PyPI) vulnerabilities 9 known vulnerabilities (4 critical, 5 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.6.6 (Sep 10, 2026): no advisory affects it - Newest unaffected release: 2.6.6 (Sep 10, 2026), the latest release - Weekly downloads: 2.7M - Dependents: 1,751 - Releases: 223 since 0.0.2 (Mar 31, 2019) - Registry: https://pypi.org/project/pytorch-lightning/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-58659: 0.0.2 to 2.6.5 (2.6.6 is outside it) - CVE-2026-44484: no published release is affected - CVE-2026-31221: 0.0.2 to 2.6.0 (2.6.1 is outside it) - CVE-2024-8020: 0.0.2 to 2.3.2 (2.3.3 is outside it) - CVE-2024-8019: 0.0.2 to 2.3.3 (2.4.0 is outside it) - CVE-2024-5980: 0.0.2 to 2.3.2 (2.3.3 is outside it) - CVE-2024-5452: 0.0.2 to 2.3.2 (2.3.3 is outside it) - CVE-2022-0845: 0.0.2 to 1.6.0rc1 (1.6.0 is outside it) - CVE-2021-4118: 0.0.2 to 1.6.0rc1 (1.6.0 is outside it) ## Advisories (9) ### [CVE-2026-58659](https://cve.now/CVE-2026-58659): PyTorch Lightning Arbitrary Code Execution via \_instantiator Hyperparameter - Severity: High 8.4 - Published: Jul 15, 2026 - Affected: fixed in 2.6.6. - Fixed in 2.6.6 (released Sep 10, 2026, 57 days after disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2026-44484](https://cve.now/CVE-2026-44484): Compromise of PyTorch Lightning PyPi Package Versions - Severity: Critical 9.3 - Published: May 14, 2026 - Affected: from 2.6.2, fixed in 2.6.4; versions 2.6.2; versions 2.6.3. - Fixed in 2.6.4 (released May 20, 2026, 6 days after disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2026-31221](https://cve.now/CVE-2026-31221): PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading… - Severity: High 8.8 - Published: May 12, 2026 - Affected: through 2.6.0. - Fixed in 2.6.1 (released Jan 30, 2026, 102 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.6.6, is not affected. ### [CVE-2024-8020](https://cve.now/CVE-2024-8020): Denial of Service in lightning-ai/pytorch-lightning - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: through 2.3.2. - Fixed in 2.3.3 (released Jul 8, 2024, 255 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.6.6, is not affected. ### [CVE-2024-8019](https://cve.now/CVE-2024-8019): Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning - Severity: Critical 9.1 - Published: Mar 20, 2025 - Affected: fixed in 2.4.0. - Fixed in 2.4.0 (released Aug 7, 2024, 225 days before disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2024-5980](https://cve.now/CVE-2024-5980): Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning - Severity: Critical 9.1 - Published: Jun 27, 2024 - Affected: fixed in 2.3.3. - Fixed in 2.3.3 (released Jul 8, 2024, 11 days after disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2024-5452](https://cve.now/CVE-2024-5452): RCE via Property/Class Pollution in lightning-ai/pytorch-lightning - Severity: Critical 9.8 - Published: Jun 6, 2024 - Affected: fixed in 2.3.3. - Fixed in 2.3.3 (released Jul 8, 2024, 32 days after disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2022-0845](https://cve.now/CVE-2022-0845): Code Injection in pytorchlightning/pytorch-lightning - Severity: High 7.3 - Published: Mar 5, 2022 - Affected: fixed in 1.6.0; fixed in 1.6.0. - Fixed in 1.6.0 (released Mar 29, 2022, 24 days after disclosure). - The latest release, 2.6.6, is not affected. ### [CVE-2021-4118](https://cve.now/CVE-2021-4118): Deserialization of Untrusted Data in pytorchlightning/pytorch-lightning - Severity: High 7.8 - Published: Dec 23, 2021 - Affected: fixed in 1.6.0; fixed in 1.6.0. - Fixed in 1.6.0 (released Mar 29, 2022, 96 days after disclosure). - The latest release, 2.6.6, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pytorch-lightning Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.