EUVD-2026-29096
GHSA-jj3w-p9wg-m6hq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitation needs a victim to locally run the tool over an attacker-supplied file, so AV:L and UI:R; pickle deserialization yields full code execution, hence C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its make_parquet_list.py data processing tool. The script loads PyTorch .pt files (utterance embeddings, speaker embeddings, speech tokens) using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing malicious .pt files within a data directory. When a victim processes this directory using the tool, arbitrary code is executed on the victim's system.
AnalysisAI
Arbitrary code execution in CosyVoice (FunAudioLLM's multilingual text-to-speech toolkit) through commit 6e01309 allows an attacker to run code on a victim's machine via a malicious PyTorch .pt file. The vulnerability lives in the make_parquet_list.py data-preparation tool, which calls torch.load() without weights_only=True, so any .pt file it ingests can carry a malicious pickle payload that executes when the victim processes an attacker-supplied data directory. Reported by MITRE with a low EPSS (0.02%, 5th percentile) and no public exploit identified at time of analysis; this is a poisoned-input/supply-chain style flaw rather than a remotely reachable network service.
Technical ContextAI
CosyVoice is a PyTorch-based speech/TTS toolkit that stores utterance embeddings, speaker embeddings, and speech tokens as serialized .pt tensor files. The root cause is CWE-502 (Deserialization of Untrusted Data): PyTorch's torch.load() defaults to the Python pickle module, which reconstructs arbitrary objects and invokes their __reduce__ methods during unpickling, enabling code execution. Passing weights_only=True restricts loading to plain tensors/primitives and is the documented mitigation; make_parquet_list.py omits it, so it will faithfully execute any pickle opcodes embedded in the .pt files it reads. The affected component is a data-processing/training-prep utility, not the inference server, meaning exposure depends on someone running the tool over untrusted data.
RemediationAI
No vendor-released patched version is identified at time of analysis (affected versions are 'n/a' in EUVD/NVD and no fix commit is cited). The direct code-level fix is to change the torch.load() calls in make_parquet_list.py to pass weights_only=True so only tensors/primitives are deserialized; teams running from source can apply this one-line change themselves after checking that all loaded .pt files are plain tensors (weights_only can break loading of legitimately pickled non-tensor objects, so validate before rolling out). As a compensating control, only process .pt datasets from trusted, integrity-verified sources - never run make_parquet_list.py over downloaded or third-party data directories, and where feasible run the tool in a sandboxed/containerized, network-isolated account with no credentials so any executed payload is contained. Track the upstream repo (https://github.com/FunAudioLLM/CosyVoice) for an official fix and monitor the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31249.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today