CVE-2024-5452: Remote Code Execution Vulnerability in PyTorch Lightning
Summary
CVE-2024-5452: Remote code execution in pytorch lightning. Affects pytorch-lightning versions < 2.3.3. Fixed in 2.3.3. How to fix ↓
Also tracked for
The same CVE-2024-5452 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PyTorch Lightning is a popular library designed to simplify the process of training and deploying deep learning models. It provides a high-level interface for PyTorch, allowing users to focus on the model architecture and training logic while abstracting away much of the boilerplate code. The library is widely used in the machine learning community for its ease of use and flexibility. However, it has been found to have a critical vulnerability that could lead to remote code execution if not addressed promptly.
Vulnerability Detail
A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attributes, allowing an attacker to construct a serialized delta that passes the deserializer whitelist and contains dunder attributes. When processed, this can be exploited to access other modules, classes, and instances, leading to arbitrary attribute write and total RCE on any self-hosted pytorch-lightning application in its default configuration, as the delta endpoint is enabled by default.
How To Fix
Latest published version: 2.6.6 as of 23 Oct 2026
pip install --upgrade "pytorch-lightning==2.6.6"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.3
This is the first release that contains the fix.
pip install --upgrade "pytorch-lightning==2.3.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider disabling the delta endpoint in your application configuration to mitigate the risk of exploitation until you can apply the patch.
Conclusion
The CVE-2024-5452 vulnerability in PyTorch Lightning poses a significant risk of remote code execution due to improper handling of user input. It is crucial for users of the library to update to the patched version 2.3.3 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for pytorch-lightning →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
The vulnerability affects PyTorch Lightning version 2.2.1 and earlier versions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package, consider disabling the delta endpoint in your application configuration as a temporary workaround.
More information can be found in the official advisory or the GitHub repository for PyTorch Lightning.
References
Related vulnerabilities
Recent vulnerabilities recorded for pytorch-lightning.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
