The config key that runs code: catching the CVE-2026-58659 class_path/_instantiator vector statically
Safetensors solved the "the weights file runs code" problem. But a model ships with more than weights — it ships a config . And on the PyTorch-Lightning stack, two keys in that config could, until recently, pick which Python class gets imported and called when a checkpoint loads. This post is a plain walk through CVE-2026-58659 , why weights_only=True did not stop it, and a small, free static…
The CVE-2026-58659 vulnerability in PyTorch Lightning allows for arbitrary code execution during model loading. This occurs because the config key that runs code, _instantiator, can be manipulated to trigger an import-and-call during the loading process, bypassing the weights_only=True security measure. The vulnerability affects PyTorch Lightning versions up to 2.6.5, but was fixed in version 2.6.6.
The jsonargparse library, used by PyTorch Lightning, also addressed the issue with its own fix in version 5.0.0. The vulnerability stems from the config file containing a _class_path string, which is passed to jsonargparse's import_object function, causing an import side effect that can fire even when the resulting class would later be rejected.
A scanner has been developed to detect this pattern before anything loads, and it is designed to flag the pattern (JAC001, JAC002, and JAC003) in config files, exiting with a non-zero status if the issue is found. It is important to note that this scanner is not a zero-day and only flags the pattern, leaving the final decision to the user.
The recommended solution is to upgrade both PyTorch Lightning and jsonargparse to their respective fixed versions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
