PyPI/lightning CVE-2026-58659: high 7.8, EPSS 0.63%

PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters

Action: Upgrade lightning to 2.6.6 or later.

pip install lightning==2.6.6

Affected

Fixed versions

Sources

• osv: GHSA-qqmf-gpg7-g8gw
• https://nvd.nist.gov/vuln/detail/CVE-2026-58659
• https://github.com/Lightning-AI/pytorch-lightning/issues/21822
• https://github.com/Lightning-AI/pytorch-lightning/pull/21832
• https://github.com/Lightning-AI/pytorch-lightning/commit/d710d689510d50e800f53b3cd773cbca20b1f86f
• https://github.com/Lightning-AI/pytorch-lightning
• https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.6
• https://github.com/advisories/GHSA-qqmf-gpg7-g8gw
• https://github.com/pypa/advisory-database/tree/main/vulns/lightning/PYSEC-2026-3624.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2026-3967.yaml
• https://www.vulncheck.com/advisories/pytorch-lightning-arbitrary-code-execution-via-instantiator-hyperparameter

CVE-2026-58659 · published 2026-07-15T18:31:58Z · modified 2026-09-24T15:45:09.719284514Z · JSON