ESPnet CVE-2026-112086

Exploitation requires a victim to obtain and load an untrusted/attacker-supplied ESPnet model bundle through the espnet3 Inference Model Handler (build_model → read_bundle), where the bundle's inference config (conf/inference.yaml) contains an attacker-controlled _target_; pre-patch there was no namespace restriction, so Hydra's instantiate() resolves and calls any target, including nested ones inside arguments. The limiting factor is user interaction (UI:P): there is no attack against a running default service - the victim must choose to load the malicious bundle, and the patched path is additionally guarded unless trust_user_code=True is set. No authentication is required (PR:N), but the bundle must be delivered to and loaded by the target.

This is a CWE-502 deserialization/arbitrary-instantiation flaw in ESPnet's espnet3 Inference Model Handler (build_model / read_bundle), where Hydra's instantiate() recursively resolves and calls any _target_ string in an untrusted model bundle's inference config. The source diff is the strongest signal: the fix explicitly denies targets like os.system, subprocess.run/Popen, builtins.eval/exec, and torch.load, confirming the pre-patch behavior permits full arbitrary code execution, not merely limited data tampering. This creates a sharp conflict in the signals. VulDB's CVSS 4.0 score of 2.1 with only Low vulnerable-system impacts (VC:L/VI:L/VA:L) materially understates the technical impact - recursive Hydra instantiation of attacker-chosen callables is code execution in the loading process, which the code evidence supports as High across C/I/A. A public exploit (poc.zip) exists (POC=YES), so weaponization effort is low, but the vector is gated on the victim loading an attacker-supplied model bundle (UI:P in the vendor vector), making this a supply-chain / social-engineering class issue rather than a remotely-sprayable service bug. Not listed in CISA KEV and no EPSS value was provided; there is no evidence of active exploitation - only published POC code, which is a distinct signal from in-the-wild use. Net: real technical severity (RCE) is higher than the 2.1 headline, but real-world urgency is moderated by the required user interaction and ESPnet's research-oriented deployment profile.

An attacker publishes a malicious ESPnet model bundle whose conf/inference.yaml sets a crafted _target_ (e.g. os.system or subprocess.run, or a nested target inside an argument). When a victim loads that bundle via the Inference Model Handler's build_model/read_bundle, Hydra recursively instantiates every _target_ and executes the attacker's callable with attacker-supplied arguments, achieving code execution in the victim's process. A public proof-of-concept (poc.zip) is available, lowering the barrier to exploitation.