[GHSA-qqmf-gpg7-g8gw] PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters - #9662
Merged
advisory-database[bot] merged 2 commits intoSep 24, 2026
Conversation
github-actions
Bot
changed the base branch from
main
to
gabrieldernbach/advisory-improvement-9662
September 21, 2026 20:27
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
It removes a valid CVSS v3 score and omits the affected pytorch-lightning distribution.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (2)
What changed in this PR
Corrects the affected version range for the PyTorch Lightning advisory.
Changes:
- Sets the fixed
lightningversion to 2.6.6. - Adds the upstream 2.6.6 release reference.
- Removes the CVSS v3 severity entry.
| File | Description |
|---|---|
GHSA-qqmf-gpg7-g8gw.json |
Updates version, severity, timestamp, and references. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| }, | ||
| { | ||
| "fixed": "2022.6.15" | ||
| "fixed": "2.6.6" |
Comment on lines
12
to
14
| { | ||
| "type": "CVSS_V4", | ||
| "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" |
advisory-database
Bot
merged commit Sep 24, 2026
5892fe6
into
gabrieldernbach/advisory-improvement-9662
5 checks passed
Contributor
|
Hi @gabrieldernbach! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
advisory-database
Bot
deleted the
gabrieldernbach-GHSA-qqmf-gpg7-g8gw
branch
September 24, 2026 15:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Comments
The current range marks Lightning 2.6.6 as vulnerable. PyPA advisory PYSEC-2026-3624 records 2.6.6 as fixed, and the upstream 2.6.6 release includes the fix.
This proposes affected versions <2.6.6 and patched version 2.6.6. Please verify against:
https://github.com/pypa/advisory-database/blob/main/vulns/lightning/PYSEC-2026-3624.yaml
https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.6