Description (CNA)
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Lightning-AI / pytorch-lightning | affected 2.6.2; affected 2.6.3 |
CWE
CWE-506
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in PyTorch Lightning. This deep learning framework introduced functionality that could be leveraged as a credential harvesting mechanism. A remote attacker could exploit this to obtain sensitive user credentials, leading to significant information disclosure and potential further system compromise.