{"id":"CVE-2026-31221","title":"pytorch-lightning: PyTorch-Lightning: Arbitrary code execution via insecure deserialization of checkpoint files (CVE-2026-31221)","summary":"A flaw was found in PyTorch-Lightning. This vulnerability, categorized as insecure deserialization (CWE-502), exists in the checkpoint loading mechanism. A remote attacker can exploit this by providing a maliciously crafted checkpoint file…","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-502","vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","affected":["ai_inference_server","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai"],"published":"2026-05-12","updated":"2026-09-24","sourceUpdated":"2026-09-24T17:24:29+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31221.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31221.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-31221"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476502"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31221"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31221"},{"url":"https://github.com/Lightning-AI/pytorch-lightning"},{"url":"https://www.notion.so/CVE-2026-31221-35d1e1393188815f8db7c4fd08076639"},{"url":"https://pypi.org/project/pytorch-lightning"},{"url":"https://github.com/advisories/GHSA-75m9-98v2-hjpm"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00554,"epssPercentile":0.43802,"aliases":["GHSA-75m9-98v2-hjpm","PYSEC-2026-3043","PYSEC-2026-3972"],"ecosystem":"pip","scores":{"vendor":8,"osv":7.8},"ingestedAt":"2026-07-13T18:57:54.195Z","slug":"CVE-2026-31221","body":"## Overview\n\nA flaw was found in PyTorch-Lightning. This vulnerability, categorized as insecure deserialization (CWE-502), exists in the checkpoint loading mechanism. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, which, when loaded by the LightningModule.load_from_checkpoint() method, allows the deserialization of arbitrary Python objects. This can lead to arbitrary code execution on the victim's system.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31221.json)\n\n**pytorch-lightning: PyTorch-Lightning: Arbitrary code execution via insecure deserialization of checkpoint files** — rated Important by Red Hat. Released 2026-05-12, updated 2026-09-24.\n\nAffected:\n\n- Red Hat AI Inference Server\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Red Hat AI Inference Server\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\n## Remediation\n\nWill not fix\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, avoid loading PyTorch-Lightning checkpoint files from untrusted or unverified sources. Ensure that all checkpoint files originate from trusted environments to prevent the deserialization of malicious Python objects and subsequent arbitrary code execution.\n\n## Package advisory (CVE-2026-31221)\n\nAffected packages:\n\n- `pytorch-lightning <= 2.6.0`\n\nSource: https://osv.dev/vulnerability/GHSA-75m9-98v2-hjpm","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":210679,"id":"CVE-2026-31221","ts":1790322175354,"field":"cvss","old":"7.8","new":"8"}]}