What is the CVSS score of CVE-2026-31251?

CVE-2026-31251 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of CosyVoice are affected by CVE-2026-31251?

CosyVoice's speech-synthesis service contains a code-execution vulnerability triggered when loading model files, creating a path to system compromise if untrusted models are deployed.

How to fix or mitigate CVE-2026-31251?

Within 24 hours, inventory all production and development CosyVoice deployments and audit the provenance and validation procedures for loaded models. Within 7 days, implement compensating controls: restrict model directories to read-only with cryptographic integrity verification, establish a whitelist of approved model sources, disable the gRPC server if not operationally required, and enforce principle of least privilege on file system access to model directories. Within 30 days, monitor the CosyVoice project repository for security patch releases, establish a vendor communication channel for advisories, and develop an upgrade plan to deploy patches when available.

CosyVoice CVE-2026-31251

EUVD-2026-29098 HIGH

Improper Input Validation (CWE-20)

2026-05-11 mitre

GHSA-7mm4-fwjj-qfpc

RCE Python Deserialization N A

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.8 HIGH

Attacker supplies a malicious model file but the victim must start the server against it (UI:R) and the trigger is local file deserialization (AV:L); successful exploitation yields full code execution, so C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:06 vuln.today

CVSS changed

May 12, 2026 - 20:22 NVD

7.3 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.3

DescriptionCVE.org

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its gRPC server component. When the server starts, it loads the speech synthesis model from a user-specified directory using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing malicious model files within a directory. When a victim starts the gRPC server pointing to this directory, arbitrary code is executed on the victim's system during server initialization.

AnalysisAI

Arbitrary code execution in CosyVoice's gRPC server (through commit 6e01309e) occurs because the speech-synthesis model is loaded via torch.load() without weights_only=True, deserializing untrusted pickle data. Any operator who starts the gRPC server against an attacker-supplied model directory executes embedded Python code during initialization. No public exploit has been identified and it is not in CISA KEV; EPSS is negligible at 0.02% (5th percentile), consistent with a file-delivery attack rather than mass remote exploitation.

Technical ContextAI

CosyVoice is an open-source multilingual text-to-speech toolkit (FunAudioLLM). Its gRPC serving component loads a serialized PyTorch model from a user-specified path using torch.load(). PyTorch's torch.load() defaults to Python's pickle module, which reconstructs arbitrary objects by invoking their __reduce__/__setstate__ methods - meaning a crafted .pt/.pth file can run arbitrary code the moment it is deserialized. The fix class is to pass weights_only=True (restricting unpickling to tensors/primitives). The description identifies this as insecure deserialization (CWE-502); note the input feed lists CWE-20 (Improper Input Validation) as the machine-readable weakness, a broader parent class, so treat CWE-502 as the precise root cause.

RemediationAI

No vendor-released patch version is identified at time of analysis; the references point to the project repository (https://github.com/FunAudioLLM/CosyVoice) rather than a tagged fixed release, so track the repo for a commit adding weights_only=True to the torch.load() call and rebuild from that commit once published. As immediate compensating controls: only load model files from trusted, integrity-verified sources (checksums/signatures) and never point the gRPC server at directories writable by or received from untrusted parties; run the server as an unprivileged, sandboxed/containerized user with no outbound network and read-only mounts to limit blast radius if malicious code runs; and, if you build from source, locally patch the load call to pass weights_only=True (trade-off: may break loading of legitimate models that serialize non-tensor Python objects, requiring re-export of trusted models). Restrict filesystem and deployment access so operators cannot be tricked into loading attacker-staged directories.