pytorch-lightning 1.2.9

Direct Vulnerabilities

Known vulnerabilities in the pytorch-lightning package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') via the `_load_state` function that imports and executes module names specified in checkpoint `_instantiator` hyperparameters. An attacker can achieve arbitrary code execution by providing a malicious checkpoint file that is loaded through the `load_from_checkpoint` function. How to fix Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')? A fix was pushed into the `master` branch but not yet published.	[0,)
C Deserialization of Untrusted Data pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the `LightningModule.load_from_checkpoint` function. Any workflow that calls this function on an untrusted `.ckpt` inherits PyTorch’s unsafe unpickling defaults. Malicious checkpoints can embed arbitrary pickle gadgets, achieving code execution the moment Lightning restores weights. How to fix Deserialization of Untrusted Data? Upgrade `pytorch-lightning` to version 2.6.1 or higher.	[,2.6.1)
H Denial of Service (DoS) pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Denial of Service (DoS) through the `/api/v1/state` endpoint of `LightningApp`. An attacker can cause the server to shut down by sending an unexpected POST request with improper state values. How to fix Denial of Service (DoS)? Upgrade `pytorch-lightning` to version 2.4.0 or higher.	[,2.4.0)
H Arbitrary File Upload pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Arbitrary File Upload via the `LightningApp` when running on a Windows host at the `/api/v1/upload_file/` endpoint. An attacker can write or overwrite arbitrary files by providing a crafted filename, potentially leading to remote code execution by overwriting critical files or placing malicious files in sensitive locations. How to fix Arbitrary File Upload? Upgrade `pytorch-lightning` to version 2.4.0 or higher.	[,2.4.0)
H Unrestricted Upload of File with Dangerous Type pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Unrestricted Upload of File with Dangerous Type through the `/v1/runs` API endpoint when extracting tar.gz files. An attacker can deploy the malicious `tar.gz` plugins that exploit path traversal vulnerabilities, allowing to write files to arbitrary locations on the victim's file system. How to fix Unrestricted Upload of File with Dangerous Type? Upgrade `pytorch-lightning` to version 2.4.0 or higher.	[0,2.4.0)
C Improper Restriction of Operations within the Bounds of a Memory Buffer pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. An attacker can execute arbitrary code and manipulate application state by constructing a serialized delta that includes dunder attributes. How to fix Improper Restriction of Operations within the Bounds of a Memory Buffer? Upgrade `pytorch-lightning` to version 2.3.3 or higher.	[0,2.3.3)
H Command Injection pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Command Injection by setting the `PL_TRAINER_GPUS` when using the `Trainer` module. How to fix Command Injection? Upgrade `pytorch-lightning` to version 1.6.0rc0 or higher.	[,1.6.0rc0)
H Deserialization of Untrusted Data pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via `saving.py` functionality which is calling `yaml.UnsafeLoader` from `pyyaml` Python library which is not a secure method. Because of that, maliciously crafted `yaml` config file can cause code execution on the victim's machine. How to fix Deserialization of Untrusted Data? Upgrade `pytorch-lightning` to version 1.6.0rc0 or higher.	[,1.6.0rc0)

Vulnerability

Vulnerable Version

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')