Homepage

pytorch-lightning@1.2.9 vulnerabilities

PyTorch Lightning is the lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.

  • latest version

    2.5.2

  • latest non vulnerable version

    2.5.2

  • first published

    6 years ago

  • latest version published

    16 days ago

  • licenses detected

  • View pytorch-lightning package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the pytorch-lightning package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Denial of Service (DoS)

    pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.

    Affected versions of this package are vulnerable to Denial of Service (DoS) through the /api/v1/state endpoint of LightningApp. An attacker can cause the server to shut down by sending an unexpected POST request with improper state values.

    How to fix Denial of Service (DoS)?

    Upgrade pytorch-lightning to version 2.4.0 or higher.

    [,2.4.0)
    • H
    Arbitrary File Upload

    pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.

    Affected versions of this package are vulnerable to Arbitrary File Upload via the LightningApp when running on a Windows host at the /api/v1/upload_file/ endpoint. An attacker can write or overwrite arbitrary files by providing a crafted filename, potentially leading to remote code execution by overwriting critical files or placing malicious files in sensitive locations.

    How to fix Arbitrary File Upload?

    Upgrade pytorch-lightning to version 2.4.0 or higher.

    [,2.4.0)
    • H
    Unrestricted Upload of File with Dangerous Type

    pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.

    Affected versions of this package are vulnerable to Unrestricted Upload of File with Dangerous Type through the /v1/runs API endpoint when extracting tar.gz files. An attacker can deploy the malicious tar.gz plugins that exploit path traversal vulnerabilities, allowing to write files to arbitrary locations on the victim's file system.

    How to fix Unrestricted Upload of File with Dangerous Type?

    Upgrade pytorch-lightning to version 2.4.0 or higher.

    [0,2.4.0)
    • C
    Improper Restriction of Operations within the Bounds of a Memory Buffer

    pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.

    Affected versions of this package are vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. An attacker can execute arbitrary code and manipulate application state by constructing a serialized delta that includes dunder attributes.

    How to fix Improper Restriction of Operations within the Bounds of a Memory Buffer?

    Upgrade pytorch-lightning to version 2.3.3 or higher.

    [0,2.3.3)
    • H
    Command Injection

    pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.

    Affected versions of this package are vulnerable to Command Injection by setting the PL_TRAINER_GPUS when using the Trainer module.

    How to fix Command Injection?

    Upgrade pytorch-lightning to version 1.6.0rc0 or higher.

    [,1.6.0rc0)
    • H
    Deserialization of Untrusted Data

    pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.

    Affected versions of this package are vulnerable to Deserialization of Untrusted Data via saving.py functionality which is calling yaml.UnsafeLoader from pyyaml Python library which is not a secure method. Because of that, maliciously crafted yaml config file can cause code execution on the victim's machine.

    How to fix Deserialization of Untrusted Data?

    Upgrade pytorch-lightning to version 1.6.0rc0 or higher.

    [,1.6.0rc0)
    Go back to all versions of this package