CVE-2022-0845: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2022-03-05T22:15Z
Repository: https://github.com/pytorchlightning/pytorch-lightning
Language: Python
Files changed: CHANGELOG.md, pytorch_lightning/utilities/argparse.py
Commit date: 2022-03-05 18:38:16 +0000
Commit message: Replace `eval()` with `ast.literal_eval()` for security (#12212)

Co-authored-by: Carlos Mocholi <carlossmocholi@gmail.com>
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 225fced44..7bfe08edb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -661,13 +661,17 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 - Fixed an issue where `ModelCheckpoint` could delete older checkpoints when `dirpath` has changed during resumed training ([#12045](https://github.com/PyTorchLightning/pytorch-lightning/pull/12045))
 
 
 - Fixed an issue where `HorovodStrategy.teardown()` did not complete gracefully if an exception was thrown during callback setup [#11752](https://github.com/PyTorchLightning/pytorch-lightning/pull/11752)
 
+
 - Fixed security vulnerabilities CVE-2020-1747 and CVE-2020-14343 caused by the `PyYAML` dependency ([#11099](https://github.com/PyTorchLightning/pytorch-lightning/pull/11099))
 
 
+- Fixed security vulnerability "CWE-94: Improper Control of Generation of Code (Code Injection)" ([#12212](https://github.com/PyTorchLightning/pytorch-lightning/pull/12212))
+
+
 - Fixed logging on `{test,validation}_epoch_end` with multiple dataloaders ([#11132](https://github.com/PyTorchLightning/pytorch-lightning/pull/11132))
 
 
 - Reset the validation progress tracking state after sanity checking ([#11218](https://github.com/PyTorchLightning/pytorch-lightning/pull/11218))
 
diff --git a/pytorch_lightning/utilities/argparse.py b/pytorch_lightning/utilities/argparse.py
index e729f862c..8927ff093 100644
--- a/pytorch_lightning/utilities/argparse.py
+++ b/pytorch_lightning/utilities/argparse.py
@@ -15,10 +15,11 @@
 
 import inspect
 import os
 from abc import ABC
 from argparse import _ArgumentGroup, ArgumentParser, Namespace
+from ast import literal_eval
 from contextlib import suppress
 from functools import wraps
 from typing import Any, Callable, cast, Dict, List, Tuple, Type, TypeVar, Union
 
 import pytorch_lightning as pl
@@ -119,11 +120,11 @@ def parse_env_variables(cls: Type["pl.Trainer"], template: str = "PL_%(cls_name)
         val = os.environ.get(env)
         if not (val is None or val == ""):
             # todo: specify the possible exception
             with suppress(Exception):
                 # converting to native types like int/float/bool
-                val = eval(val)
+                val = literal_eval(val)
             env_args[arg_name] = val
     return Namespace(**env_args)
 
 
 def get_init_arguments_and_types(cls: Any) -> List[Tuple[str, Tuple, Any]]:

Vulnerable code:                 val = eval(val)
Fixed code: 
- Fixed security vulnerability "CWE-94: Improper Control of Generation of Code (Code Injection)" ([#12212](https://github.com/PyTorchLightning/pytorch-lightning/pull/12212))


from ast import literal_eval
                val = literal_eval(val)