CVE-2026-31221 describes an insecure deserialization vulnerability (CWE-502) in PyTorch-Lightning versions 2.6.0 and earlier. The LightningModule.load_from_checkpoint() method internally calls torch.load() without setting the weights_only=True parameter, which would restrict deserialization to model weights only. This omission allows deserialization of arbitrary Python objects via Pickle, enabling a remote attacker to execute arbitrary code by providing a malicious checkpoint file. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to arbitrary code execution on the victim system when a malicious checkpoint file is loaded. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability can be triggered remotely by supplying a crafted checkpoint file, making it a significant risk for users loading checkpoints from untrusted sources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading checkpoint files from untrusted or unauthenticated sources. Consider manually inspecting checkpoint files or restricting usage to trusted environments. Monitor vendor channels for updates regarding patches or official mitigations.