PyTorch Lightning Remote Code Execution via Checkpoint

Executive Summary

This vulnerability in PyTorch Lightning (CVE-2026-58659) allows arbitrary code execution through malicious checkpoint files. The issue is in the _load_state function which imports and executes attacker-controlled module names from the _instantiator hyperparameter in checkpoints. Even with weights_only=True protections enabled, attackers can bypass these safeguards to run arbitrary code when LightningModule.load_from_checkpoint is called.

The vulnerability exists because the _instantiator parameter is processed before validation, allowing dynamic imports of untrusted code. The fix restricts _instantiator resolution to a predefined allowlist of trusted instantiators.

Useful 0 Not Useful 0

Impact Analysis

If you use PyTorch Lightning versions up to 2.6.5, an attacker could craft a malicious checkpoint file that executes arbitrary code on your system when you load the file using load_from_checkpoint. This could lead to data theft, system compromise, or further network infiltration depending on your environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected PyTorch Lightning versions may face compliance violations if exploited.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect PyTorch Lightning versions. Run: pip show pytorch-lightning. If version <=2.6.5, it is vulnerable. Check for malicious checkpoint files by examining _instantiator hyperparameters in .ckpt files using a text editor or hex editor.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade PyTorch Lightning to a version beyond 2.6.5. Avoid loading untrusted checkpoint files. If loading is necessary, validate _instantiator values against a trusted allowlist. Disable dynamic imports from checkpoint hyperparameters.

Useful 0 Not Useful 0