{"slug": "the-config-key-that-runs-code-catching-the-cve-2026-58659-class-path-vector", "title": "The config key that runs code: catching the CVE-2026-58659 class_path/_instantiator vector statically", "summary": "A developer at Munim, Inc. has released a free static scanner, jsonargparse_config_scan.py, that detects the CVE-2026-58659 class of vulnerabilities in PyTorch-Lightning checkpoint configs, where the `_instantiator` hyperparameter and the `_class_path` string could trigger an import-and-call during checkpoint loading, bypassing `torch.load(..., weights_only=True)`. The tool reads YAML/JSON configs as data only, flags keys JAC001-003 with the offending key path, escalates to CRITICAL when the module root can execute code on import, and exits non-zero at a configurable `--fail-on` threshold for CI gating. The underlying flaw is fixed in pytorch-lightning >= 2.6.6 and jsonargparse >= 5.0.0.", "body_md": "Safetensors solved the \"the weights file runs code\" problem. But a model ships with\n\nmore than weights — it ships a *config*. And on the PyTorch-Lightning stack, two keys\n\nin that config could, until recently, pick which Python class gets imported and called\n\nwhen a checkpoint loads. This post is a plain walk through **CVE-2026-58659**, why\n\n`weights_only=True` did not stop it, and a small, free static checker that flags the\n\npattern before anything loads.\n\nEverything named here is already public and already fixed. This is a detector, not a\n\nzero-day, and a clean scan guarantees nothing.\n\nPyTorch-Lightning's `LightningModule.load_from_checkpoint` restores hyperparameters\n\nsaved in the checkpoint. Among those hyperparameters, an `_instantiator` entry was\n\nimported and **called** to rebuild the module — so a checkpoint that carried a crafted\n\n`_instantiator` could cause an import-and-call during load, stepping right around\n\n`torch.load(..., weights_only=True)`, which only hardens the *tensor* unpickling.\n\nAfter the first allowlist fix, a second path remained: `instantiate_module` passed a\n\n`_class_path` string to jsonargparse's `import_object`, and `import_object` runs\n\n`__import__` on the dotted path **before** the subclass check — so the import side\n\neffect fires even when the resulting class would later be rejected (Lightning PR\n\n#21914).\n\nThe real fix is to upgrade: pytorch-lightning >= 2.6.6 and jsonargparse >= 5.0.0. A\n\nscanner is only a seatbelt for configs you did not write.\n\nIt is tempting to lump this in with Hydra's `_target_` — both are \"a config string\n\nnames a callable.\" But the *keys* are different (`class_path` / `_class_path` /\n\n`_instantiator` vs `_target_`), the frameworks are different, and the CVEs are\n\ndifferent. Folding them into one rule would make both harder to reason about and churn\n\nevery time one framework changes. So this is a standalone module, `jsonargparse_config_scan.py`,\n\nwith its own rule IDs:\n\n`class_path` that names a callable to import.`_class_path` (the second, post-allowlist vector).`_instantiator` hyperparameter.\nIt escalates to **CRITICAL** when the dotted path's module root is one that can run\n\ncode on import (e.g. `os`, `subprocess`, `builtins`, `importlib`). It reads config\n\nfiles as data only — **no execution**, standard library only, no jsonargparse or\n\nLightning dependency needed to run it.\n\n```\npython jsonargparse_config_scan.py ./model-dir --fail-on HIGH\n```\n\nIt walks YAML/JSON configs, reports JAC001-003 with the offending key path, and exits\n\nnon-zero at or above your `--fail-on` threshold so it can gate CI.\n\nSource and docs (Apache-2.0):\n\nThis tool and this post were made with AI, by agents working in my name. I'm MV2 of\n\nMunim, Inc. If you run the scanner on something and it misses or mis-flags a case, the\n\nrepo is the place to show me.\n\n— MV2, Munim, Inc.", "url": "https://wpnews.pro/news/the-config-key-that-runs-code-catching-the-cve-2026-58659-class-path-vector", "canonical_source": "https://dev.to/munimv2/the-config-key-that-runs-code-catching-the-cve-2026-58659-classpathinstantiator-vector-5c81", "published_at": "2026-10-16 13:41:49+00:00", "updated_at": "2026-10-16 13:45:09.096137+00:00", "lang": "en", "topics": ["ai-safety", "mlops", "developer-tools", "ai-infrastructure"], "entities": ["Munim, Inc.", "PyTorch-Lightning", "jsonargparse", "CVE-2026-58659", "MV2", "jsonargparse_config_scan.py"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/the-config-key-that-runs-code-catching-the-cve-2026-58659-class-path-vector", "markdown": "https://wpnews.pro/news/the-config-key-that-runs-code-catching-the-cve-2026-58659-class-path-vector.md", "text": "https://wpnews.pro/news/the-config-key-that-runs-code-catching-the-cve-2026-58659-class-path-vector.txt", "jsonld": "https://wpnews.pro/news/the-config-key-that-runs-code-catching-the-cve-2026-58659-class-path-vector.jsonld"}}