CVE-2026-58659
High
Description
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Lightningai Pytorch Lightning
PublishedJul 15, 2026
First seenJul 15, 2026
Weakness typeCWE-470CWE-470
How to fix
Update
- lightning2.6.6 or later
- pytorch-lightning2.6.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lightningai pytorch_lightning | v ≤ 2.6.5 | — |
| lightningPyPI | v < 2.6.6 | 2.6.6 |
| pytorch-lightningPyPI | v < 2.6.6 | 2.6.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.