Vulnerability · Published Mar 5, 2022 · Assigned by @huntrdev
CVE-2022-0845Code Injection in pytorchlightning/pytorch-lightning
High 7.3
In plain English
A high-severity code injection in pytorchlightning/pytorch-lightning from pytorchlightning. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)7.3High
Exploit odds (30 days)1.0%top 36.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | lightning | 1.6.0 | PYSEC-2026-3969 |
| PyPI | pytorch-lightning | 1.6.0 | GHSA-r5qj-cvf9-p85h |
| PyPI | pytorch-lightning | 1.6.0 | PYSEC-2022-181 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pytorchlightning | pytorchlightning/pytorch-lightning | unspecified – before 1.6.0 |
Weakness: CWE-94 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L