What is CVE-2024-5452?

CVE-2024-5452 is a critical-severity vulnerability in Lightning-Ai Lightning-Ai/pytorch-Lightning, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 9.8/10. Published 2024-06-06.

How severe is CVE-2024-5452?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2024-5452 known to be exploited?

6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Lightning-Ai Lightning-Ai/pytorch-Lightning

CVE-2024-5452

A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The library uses `deepdiff.Delta` objects to modify application state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attributes, allowing an attacker to construct a serialized delta that passes the deserializer whitelist and contains dunder attributes. When processed, this can be exploited to access other modules, classes, and instances, leading to arbitrary attribute write and total RCE on any self-hosted pytorch-lightning application in its default configuration, as the delta endpoint is enabled by default.

Vulnerability class: Mass Assignment

Published 2024-06-06 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.268 (98.0th percentile), scored 2026-09-29.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.268 · newest: 0.268 · change: 0.000

Affected products

Lightning-Ai Lightning-Ai/pytorch-Lightning — versions unspecified
Lightningai Pytorch Lightning

Weakness classification (CWE)

Public proof-of-concept exploits

References

huntr.com/bounties/486add92-275e-4a7b-92f9-42d84bc759da (Exploit, Third Party Advisory)
github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc…

Frequently asked questions

What is CVE-2024-5452?: CVE-2024-5452 is a critical-severity vulnerability in Lightning-Ai Lightning-Ai/pytorch-Lightning, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 9.8/10. Published 2024-06-06.
How severe is CVE-2024-5452?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2024-5452 known to be exploited?: 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.