CVE-2021-4118

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

pytorch-lightning is vulnerable to Deserialization of Untrusted Data

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
pytorchlightning	pytorchlightning/pytorch-lightning	>= unspecified, < 1.6

References

https://github.com/pytorchlightning/pytorch-lightning/commit/62f1e82e032eb16565e676d39e0db0cac7e34acePatch, Third Party Advisory
https://huntr.dev/bounties/31832f0c-e5bb-4552-a12c-542f81f111e6Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/pytorchlightning/pytorch-lightning/commit/62f1e82e032eb16565e676d39e0db0cac7e34acePatch, Third Party Advisory
https://huntr.dev/bounties/31832f0c-e5bb-4552-a12c-542f81f111e6Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Dec 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411806.1Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation previe CVE-2021-411812.4Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly dete CVE-2021-411826.1jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepi CVE-2021-411836.1jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Date CVE-2021-411846.1jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()CVE-2021-411856.5Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints t CVE-2021-411867.5Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin i CVE-2021-411878.8DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerabilit CVE-2021-411885.4Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in CVE-2021-411897.2DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permis CVE-2021-41199.8bookstack is vulnerable to Improper Access Control CVE-2021-411905.0The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution