CVE-2026-31221

PyTorch Lightning checkpoint loading can run untrusted code

Lightning AI / HCL · PyTorch Lightning in HCL AION

First documented disclosure · Review checkpoint

Summary

Untrusted saved model checkpoints can execute code during loading.

Severity and exploitation evidence

High · 7.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The model-checkpoint loader can deserialize executable Python objects during model restoration.

Conditions required

A user or service must load an untrusted Lightning checkpoint.

Potential impact

Code can run with the privileges of the model-loading process.

Affected versions and configurations

Lightning through 2.6.0. HCL AION 2.7.0.

Fix and mitigation status

HCL AION 2.8.0. Upstream release unverified.

Practical next steps

Upgrade HCL AION to 2.8.0. For separate Lightning installations, restrict checkpoints to trusted sources and verify the upstream fix for the deployed version.

Operating lesson

Model weights and serialized executable objects need different trust policies.

Evidence and limits

MITRE describes the upstream checkpoint risk. HCL separately confirms that AION 2.7.0 includes an affected component and directs customers to 2.8.0.

Sources