From ef7760ddde4b9fe18deec40930e3af7b3d748590 Mon Sep 17 00:00:00 2001 From: arielbosa <142411708+arielbosa@users.noreply.github.com> Date: Thu, 24 Sep 2026 12:30:33 -0300 Subject: [PATCH] Add pytorch-lightning to GHSA-qqmf-gpg7-g8gw affected packages The same vulnerable load_from_checkpoint implementation ships in the pytorch-lightning distribution; fixed in 2.6.6. Also corrects the lightning fixed boundary from the nonexistent 2022.6.15 to 2.6.6. Co-Authored-By: Claude Fable 5 --- .../GHSA-qqmf-gpg7-g8gw.json | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/advisories/github-reviewed/2026/07/GHSA-qqmf-gpg7-g8gw/GHSA-qqmf-gpg7-g8gw.json b/advisories/github-reviewed/2026/07/GHSA-qqmf-gpg7-g8gw/GHSA-qqmf-gpg7-g8gw.json index 4e311bd6dab2..d80e0a74792b 100644 --- a/advisories/github-reviewed/2026/07/GHSA-qqmf-gpg7-g8gw/GHSA-qqmf-gpg7-g8gw.json +++ b/advisories/github-reviewed/2026/07/GHSA-qqmf-gpg7-g8gw/GHSA-qqmf-gpg7-g8gw.json @@ -32,7 +32,26 @@ "introduced": "0" }, { - "fixed": "2022.6.15" + "fixed": "2.6.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pytorch-lightning" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.6" } ] }