{"action":"Upgrade pytorch-lightning to 1.6.0 or later.","affected":[{"fixed":"1.6.0","introduced":"0"}],"component":"pytorch-lightning","cve_ids":["CVE-2021-4118"],"ecosystem":"PyPI","epss":0.01011,"exploited":false,"fixed_versions":["1.6.0"],"ghsa_id":"GHSA-2vj5-px25-gjrp","id":"tcs_01M5KGFRN1JHPSH7KSNX0PWTJ3","modified_at":"2026-09-10T17:26:03.425101162Z","published_at":"2021-12-23T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-874","https://github.com/pytorchlightning/pytorch-lightning/commit/62f1e82e032eb16565e676d39e0db0cac7e34ace","https://huntr.dev/bounties/31832f0c-e5bb-4552-a12c-542f81f111e6","https://github.com/advisories/GHSA-2vj5-px25-gjrp"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-874","url":"https://osv.dev/vulnerability/PYSEC-2021-874"}],"summary":"pytorch-lightning is vulnerable to Deserialization of Untrusted Data"}