EUVD-2026-29097
GHSA-jf74-gj4g-6qpg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attacker supplies a malicious file processed locally (AV:L) that the victim must run the tool on (UI:R); pickle deserialization yields full code execution, so C/I/A:H, unlike the published Low impacts.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its average_model.py model averaging tool. The script loads PyTorch checkpoint files (epoch_*.pt) for model averaging using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing malicious checkpoint files within a directory. When a victim uses the tool to average models from this directory, arbitrary code is executed on the victim's system.
AnalysisAI
Arbitrary code execution in CosyVoice (FunAudioLLM's open-source multilingual text-to-speech toolkit) arises because its average_model.py utility calls PyTorch's torch.load() on epoch_*.pt checkpoint files without weights_only=True, allowing pickle-based deserialization of attacker-controlled objects. Any user who runs the model-averaging tool against a directory containing a malicious checkpoint executes attacker code on their machine. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), but the CWE-502 pattern is trivially weaponizable and SSVC marks it automatable.
Technical ContextAI
The affected component is the model-averaging helper in CosyVoice, a neural TTS/voice-cloning framework built on PyTorch. PyTorch checkpoints are Python pickle streams; torch.load() by default reconstructs arbitrary objects and will invoke __reduce__ handlers embedded in a crafted pickle, which is the classic CWE-502 (Deserialization of Untrusted Data) root cause. The introduction of the weights_only=True flag in modern PyTorch restricts loading to tensor data and known safe globals; because average_model.py omits this flag, a malicious epoch_*.pt file can carry an executable payload that runs during load. CPE data is unhelpful here (listed as cpe:2.3:a:n/a:n/a:*), so affected identification rests on the source repository (github.com/FunAudioLLM/CosyVoice) and the commit boundary named in the description.
RemediationAI
No vendor-released patch version has been identified at time of analysis; the corrective code change is to modify average_model.py to call torch.load(..., weights_only=True) (and more broadly to load checkpoints in a restricted-unpickling mode), so track the upstream repository at https://github.com/FunAudioLLM/CosyVoice for a fixed commit or release. Until a fixed build is confirmed, only run the model-averaging tool on checkpoint directories you produced or fully trust, and never on epoch_*.pt files downloaded from third parties, shared model hubs, or untrusted collaborators; treating downloaded model weights as untrusted code is the key compensating control. Optionally run the averaging step inside a sandboxed, network-isolated container or unprivileged user account so that a malicious pickle payload cannot reach sensitive credentials or persist - the trade-off is added pipeline friction and setup overhead. Verify checkpoint provenance with hashes/signatures where possible; the side effect is operational overhead maintaining a trusted-artifact inventory.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today