GHSA-r5qj-cvf9-p85h

Code Injection in PyTorch Lightning

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-0845

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pytorch-lightning	< 1.6.0	1.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the `PL_TRAINER_GPUS` when using the `Trainer` module. A [patch](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) is included in the `1.6.0` release.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-0845 advisory
https://github.com/PyTorchLightning/pytorch-lightning/pull/12212 web
https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae web
https://github.com/advisories/GHSA-r5qj-cvf9-p85h advisory
https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2022-181.yaml web
https://github.com/pytorchlightning/pytorch-lightning web
https://huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a web