CVE-2022-0845

Advisory

PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the `PL_TRAINER_GPUS` when using the `Trainer` module. A [patch](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) is included in the `1.6.0` release.
Affected functions:
pytorch_lightning.utilities.argparse.parse_env_variables

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-r5qj-cvf9-p85h
• https://nvd.nist.gov/vuln/detail/CVE-2022-0845
• https://github.com/PyTorchLightning/pytorch-lightning/pull/12212
• https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8a
• https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2022-181.yaml
• https://github.com/pytorchlightning/pytorch-lightning/
• https://huntr.dev/bounties/a795bf93-c91e-4c79-aae8-f7d8bda92e2a
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0845
• https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae