CVE-2026-58659 is a remote code execution vulnerability in PyTorch Lightning through version 2.6.5. The issue arises from the _load_state function importing and executing attacker-controlled module names derived from checkpoint _instantiator hyperparameters. This unsafe reflection allows crafted malicious checkpoint files to bypass protections intended to restrict code execution (weights_only=True) and execute arbitrary code during the loading of a LightningModule checkpoint. The vulnerability has a CVSS 4.0 score of 8.4, indicating high severity. There is no explicit vendor advisory or patch information provided, and the remediation level is not specified.

An attacker who can supply a malicious checkpoint file can achieve remote code execution on systems loading that checkpoint with PyTorch Lightning versions up to 2.6.5. This bypasses intended protections and allows arbitrary code execution in the context of the application using LightningModule.load_from_checkpoint.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid loading untrusted checkpoint files with LightningModule.load_from_checkpoint to prevent exploitation.