CVE-2026-58659CWE-470

CVE-2026-58659

High · published July 15, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00626 · 49.3th percentile
Weakness
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2026-07-15T22:16Z
Affected products (1)
ProductVersionsFixed in
lightningai/pytorch_lightning≤ 2.6.5—
References (4)
https://github.com/Lightning-AI/pytorch-lightning/commit/d710d689510d50e800f53b3cd773cbca20b1f86f · [email protected]https://github.com/Lightning-AI/pytorch-lightning/issues/21822 · [email protected]https://github.com/Lightning-AI/pytorch-lightning/pull/21832 · [email protected]https://www.vulncheck.com/advisories/pytorch-lightning-arbitrary-code-execution-via-instantiator-hyperparameter · [email protected]
EPSS history
Timeline
  • 15 JUL 17:02Z
    PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter
    cvelistv5