Lookup for vulnerable packages by Package URL.
| Purl | pkg:pypi/pytorch-lightning@0.2.5.2 |
| Type | pypi |
| Namespace | |
| Name | pytorch-lightning |
| Version | 0.2.5.2 |
| Qualifiers |
|
| Subpath | |
| Is_vulnerable | true |
| Next_non_vulnerable_version | 2.6.1 |
| Latest_non_vulnerable_version | 2.6.1 |
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-1z2t-6a26-w7c1 |
| vulnerability_id |
VCID-1z2t-6a26-w7c1 |
| summary |
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-8020, GHSA-98fp-7v67-4v3q
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1z2t-6a26-w7c1 |
|
| 1 |
|
| 2 |
| url |
VCID-dpzd-6sun-a7av |
| vulnerability_id |
VCID-dpzd-6sun-a7av |
| summary |
PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to load saved model states, internally calls torch.load() without setting the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, leading to arbitrary code execution on the victim's system when the file is loaded. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
| reference_url |
https://github.com/Lightning-AI/pytorch-lightning |
| reference_id |
pytorch-lightning |
| reference_type |
|
| scores |
| 0 |
| value |
7.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-15T18:02:25Z/ |
|
|
| url |
https://github.com/Lightning-AI/pytorch-lightning |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-31221, GHSA-75m9-98v2-hjpm
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dpzd-6sun-a7av |
|
| 3 |
| url |
VCID-rdkc-nx1c-uqc8 |
| vulnerability_id |
VCID-rdkc-nx1c-uqc8 |
| summary |
In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-8019, GHSA-4cv3-v7pv-rfhf
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rdkc-nx1c-uqc8 |
|
| 4 |
|
|
| Fixing_vulnerabilities |
|
| Risk_score | 4.5 |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:pypi/pytorch-lightning@0.2.5.2 |