GitHub Advisoryadvisory · PyPI
GHSA-r5qj-cvf9-p85h Code Injection in PyTorch Lightning
CRITICAL
Official page ↗
- Aliases
- CVE-2022-0845
- Ecosystem
- PyPI
- Packages
- pytorch-lightning
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
- Reviewed
- 2022-03-07
Affected packages
• PyPI pytorch-lightning: < 1.6.0 → fixed in 1.6.0
Description
PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the `PL_TRAINER_GPUS` when using the `Trainer` module. A patch is included in the `1.6.0` release.
Related
Alias · CVE (1)
- CVE-2022-0845 Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0. vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-0845 advisory
- https://github.com/PyTorchLightning/pytorch-lightning/pull/12212 web
- https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae web
- https://github.com/advisories/GHSA-r5qj-cvf9-p85h advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2022-181.yaml web
- https://github.com/pytorchlightning/pytorch-lightning web
- https://huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a web