What is the CVSS score of CVE-2026-31232?

CVE-2026-31232 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2026-31232?

CosyVoice, an open-source text-to-speech toolkit, contains a remote code execution vulnerability (CVE-2026-31232, CVSS 8.8) that allows arbitrary Python execution when loading malicious model files.

How to fix or mitigate CVE-2026-31232?

Within 24 hours, audit CosyVoice deployments and disable automated model loading from untrusted sources; restrict model directory access to administrative users only and document all current model sources. Within 7 days, configure network segmentation to isolate CosyVoice instances, conduct a supply chain review of model files in use, and establish a process to monitor FunAudioLLM's repository for security patches. Within 30 days, evaluate replacing CosyVoice with alternative text-to-speech solutions if vendor patches remain unavailable, or implement a model validation framework that verifies model integrity and provenance before loading.

Python CVE-2026-31232

EUVD-2026-29555 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-12 mitre

GHSA-chxf-r8w4-qgr9

RCE Python Deserialization N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:32 vuln.today

CVSS changed

May 14, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

May 12, 2026 - 00:00 nvd

HIGH 8.8

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its model loading process. When loading model files (.pt) from a user-specified directory (via the --model_dir argument), the code uses torch.load() without the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the Pickle module. An attacker can exploit this by providing a maliciously crafted model directory containing .pt files with embedded pickle payloads. When a victim loads this directory using CosyVoice's web interface, the malicious payload is executed, leading to remote code execution on the victim's system.

AnalysisAI

Remote code execution in CosyVoice (FunAudioLLM's open-source text-to-speech toolkit) up to commit 6e01309 allows an attacker to run arbitrary Python on a victim's host when the victim loads an attacker-supplied model directory. The flaw stems from calling torch.load() without weights_only=True, so malicious pickle payloads embedded in .pt model files execute during model loading via the web interface. There is no public exploit identified at time of analysis and EPSS is very low (0.05%, 17th percentile), but SSVC rates the technical impact as total.