critical9.8
CVE-2022-0845
Code Injection in PyTorch Lightning
Impact
PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the `PL_TRAINER_GPUS` when using the `Trainer` module. A [patch](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) is included in the `1.6.0` release.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pytorch-lightning | < 1.6.0 | 1.6.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lightningai | Pytorch Lightning | before 1.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae
- https://huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a
- https://github.com/advisories/GHSA-r5qj-cvf9-p85h
- https://nvd.nist.gov/vuln/detail/CVE-2022-0845
- https://github.com/PyTorchLightning/pytorch-lightning/pull/12212
- https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2022-181.yaml