Code Injection in PyTorch Lightning

CRITICAL 9.8CVE-2022-0845 · GHSA-r5qj-cvf9-p85h · PYSEC-2022-181 · Published 05/03/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
lightning PyPI	`< 1.6.0`	`1.6.0`
pytorch-lightning PyPI	`< 1.6.0`	`1.6.0`
pytorch lightning lightningai	`< 1.6.0`	`1.6.0`

Description

PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the PL_TRAINER_GPUS when using the Trainer module. A patch is included in the 1.6.0 release.

NVD description

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.

References

nvd.nist.gov/vuln/detail/CVE-2022-0845 · ADVISORY
PyTorchLightning/pytorch-lightning#12212 · WEB
pytorchlightning/pytorch-lightning commit 8b7a12c · WEB
GitHub Advisory GHSA-r5qj-cvf9-p85h · ADVISORY
pypa/advisory-database · WEB
pytorchlightning/pytorch-lightning · WEB
huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free