CVE-2026-58659High· 7.8▾ MidnightPoC availablePyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.6%
Last analysed / modified upstream
Exploit / PoC code exists
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.
pytorch_lightning <= 2.6.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
pytorch-lightning < 2.6.6Patched in:
pytorch-lightning 2.6.6Source: https://osv.dev/vulnerability/PYSEC-2026-3967
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106439High· 8.5Hydra is a framework for elegantly configuring complex applications
CVE-2026-106441High· 7.8Hydra is a framework for elegantly configuring complex applications
CVE-2026-106442High· 7.8Hydra is a framework for elegantly configuring complex applications
CVE-2026-68508High· 7.8Hydra is a framework for elegantly configuring complex applications
CVE-2026-100308High· 7.8Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a craf…
CVE-2026-106558High· 8.8Backstage is an open framework for building developer portals