PYSEC-2026-3967: PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter

Q: What action triggers exploitation?

Exploitation occurs when an application calls LightningModule.load_from_checkpoint on an attacker-crafted checkpoint file. The malicious _instantiator hyperparameter causes Lightning's _load_state function to import and execute attacker-controlled module names.

Q: Does using weights_only=True prevent this issue?

No. The malicious checkpoints described can bypass weights_only=True protections through the _instantiator hyperparameter.

Q: Who is exposed in practice?

Deployments are exposed if they load checkpoint files from untrusted or insufficiently trusted sources using LightningModule.load_from_checkpoint. An attacker does not need prior privileges, but a user or process must load the crafted checkpoint.

Q: What version boundary is provided for remediation?

PyTorch Lightning versions through 2.6.5 are affected. The issue is fixed in commit d710d68.

Published Jul 15, 2026

Updated

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weightsonly=True protections to execute arbitrary code when LightningModule.loadfromcheckpoint is called.

Affected Software

1 affected component

pypi/pytorch-lightning<=2.6.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PyTorch Lightning to a version that resolves this vulnerability.
Patch d710d68

Event History

Jul 15, 2026

CVE Published

via OSV·05:02 PM

Data Sourced

via OSV·05:02 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What action triggers exploitation?

Exploitation occurs when an application calls LightningModule.load_from_checkpoint on an attacker-crafted checkpoint file. The malicious _instantiator hyperparameter causes Lightning's _load_state function to import and execute attacker-controlled module names.

Does using weights_only=True prevent this issue?

No. The malicious checkpoints described can bypass weights_only=True protections through the _instantiator hyperparameter.

Who is exposed in practice?

Deployments are exposed if they load checkpoint files from untrusted or insufficiently trusted sources using LightningModule.load_from_checkpoint. An attacker does not need prior privileges, but a user or process must load the crafted checkpoint.

What version boundary is provided for remediation?

PyTorch Lightning versions through 2.6.5 are affected. The issue is fixed in commit d710d68.

PYSEC-2026-3967: PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter

Affected Software

Remediation

Event History

Frequently Asked Questions

What action triggers exploitation?

Does using weights_only=True prevent this issue?

Who is exposed in practice?

What version boundary is provided for remediation?

Company

Resources

Contact

Frequently Asked Questions

What action triggers exploitation?

Does using weights_only=True prevent this issue?

Who is exposed in practice?

What version boundary is provided for remediation?