Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

PyTorch‑Lightning can let attackers run unwanted code

CVE-2022-0845 · published 4 years ago
Summary

Versions of PyTorch‑Lightning released before 1.6.0 let a malicious contributor add code that runs on anyone who downloads the package. This could let an attacker execute commands or steal data on a system that installs the library. Upgrade to version 1.6.0 or later, or replace the package with a safe version, to remove the risk.

What to do
  • Update lightning to version 1.6.0.
  • Update lightning ai et al. pytorch-lightning to version 1.6.0.
  • Update lightningai pytorch_lightning to version 1.6.0 or later.
Affected software
Ecosystem VendorProductAffected versions
PyPI – lightning < 1.6.0
Fix: upgrade to 1.6.0
pip lightning ai et al. pytorch-lightning < 1.6.0
Fix: upgrade to 1.6.0
– lightningai pytorch_lightning < 1.6.0
cpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:python:*:*
Original advisory text
Code Injection in pytorchlightning/pytorch-lightning
Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published5 Mar 2022
Updated12 Oct 2026
First seen6 Mar 2026
Sources
GHSA-r5qj-cvf9-p85h · GHSA
CVE-2022-0845 · NVD
PYSEC-2026-3969 · OSV
Track software like this
Free during beta