Command Injection Affecting pytorch-lightning package, versions [,1.6.0rc0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.3% (71st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PYTORCHLIGHTNING-2419028
- published 6 Mar 2022
- disclosed 6 Mar 2022
- credit whokilleddb
How to fix?
Upgrade pytorch-lightning to version 1.6.0rc0 or higher.
Overview
pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.
Affected versions of this package are vulnerable to Command Injection by setting the PL_TRAINER_GPUS when using the Trainer module.
PoC
import os
from pytorch_lightning import Trainer
from pytorch_lightning.utilities.argparse import *
os.environ["PL_TRAINER_GPUS"] = 'os.system("touch code_injected")'
parse_env_variables(Trainer)
References
CVSS Scores
version 3.1