[GHSA-qqmf-gpg7-g8gw] PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters - #9760
Closed
GunnerStone wants to merge 1 commit into
Conversation
github-actions
Bot
changed the base branch from
main
to
GunnerStone/advisory-improvement-9760
September 23, 2026 16:51
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Both ranges incorrectly mark releases before the vulnerable code was introduced in 2.3.0 as affected.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Corrects PyTorch Lightning advisory metadata for the actual 2.6.6 patched release.
Changes:
- Updates
lightningfixed version to 2.6.6. - Adds
pytorch-lightningas affected. - Removes the CVSS v3 vector.
| File | Description |
|---|---|
GHSA-qqmf-gpg7-g8gw.json |
Updates affected packages, ranges, and severity metadata. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| }, | ||
| { | ||
| "fixed": "2022.6.15" | ||
| "fixed": "2.6.6" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Comments
Fix affected/patched version range for CVE-2026-58659 (lightning and pytorch-lightning)
The advisory currently says
< 2022.6.15with patched version2022.6.15. Neitherlightningnorpytorch-lightninghas ever published a 2022.6.15 release on PyPI, so no user can upgrade to the listed patched version. Because every real release (1.8.0 through 2.6.6) compares lower than 2022.6.15, scanners also flag the fixed 2.6.6 release as vulnerable.The advisory's own description says the issue affects releases "through 2.6.5, fixed in commit d710d68". The fix shipped in 2.6.6 (PR #21832, commit d710d689510d50e800f53b3cd773cbca20b1f86f, release tag 2.6.6). The referenced PyPA advisory PYSEC-2026-3624 was corrected on 2026-09-10 to
introduced 0, fixed 2.6.6.Proposed change:
lightning: affected< 2.6.6, patched2.6.6Add
pytorch-lightning: affected< 2.6.6, patched2.6.6. It ships the same vulnerable code (_load_state/LightningModule.load_from_checkpoint) and was fixed in the same 2.6.6 release.