CVE-2026-58659

PyTorch Lightning checkpoint metadata can bypass safe loading

Lightning AI / HCL · PyTorch Lightning in HCL AION

First documented disclosure · Review checkpoint

Summary

Untrusted checkpoint metadata can select code during model restoration.

Severity and exploitation evidence

High · 8.4/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The loader can import a class named in checkpoint metadata even when restricted weight loading is enabled.

Conditions required

A user or service must restore an untrusted Lightning checkpoint using the affected metadata path.

Potential impact

The model-loading process can execute code selected by the checkpoint author.

Affected versions and configurations

Lightning through 2.6.5. HCL AION 2.7.0.

Fix and mitigation status

Upstream commit d710d689. HCL AION 2.8.0.

Practical next steps

Use a Lightning build containing the cited upstream fix. HCL directs AION users to 2.8.0.

Operating lesson

Apply trust checks to checkpoint metadata and model weights together.

Evidence and limits

The public upstream report and the CNA identify a specific fixed commit. HCL separately lists the affected and fixed AION releases.

Sources