CVE-2026-31221

[CVE catalog]

Severity

High · CVSS 8CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Published

May 12, 2026, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.39% · Oct 25, 2026

A flaw was found in PyTorch-Lightning. This vulnerability, categorized as insecure deserialization (CWE-502), exists in the checkpoint loading mechanism. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, which, when loaded by the LightningModule.load_from_checkpoint() method, allows the deserialization of arbitrary Python objects. This can lead to arbitrary code execution on the victim's system. pytorch-lightning: PyTorch-Lightning: Arbitrary code execution via insecure deserialization of checkpoint files This is an Important arbitrary code execution flaw in PyTorch-Lightning due to insecure deserialization in its checkpoint loading mechanism. Red Hat products utilizing PyTorch-Lightning, such as Red Hat Enterprise Linux AI and Red Hat AI Inference Server, are affected if they process untrusted checkpoint files. An attacker can craft a malicious checkpoint file, which, when loaded, can lead to arbitrary code execution on the system. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.