Espnet
Monthly
Arbitrary code execution in ESPnet before v.202609 is triggered when a user loads an attacker-crafted PyTorch checkpoint through any of the framework's model initialization, fine-tuning, or averaging pipelines. The root cause is CWE-502 (Deserialization of Untrusted Data): ESPnet called torch.load with weights_only=False across at least four distinct code paths, allowing pickle-embedded payloads to execute arbitrary commands with the privileges of the ESPnet process. No public exploit has been identified at time of analysis, but the attack technique - crafting malicious PyTorch pickle checkpoints - is thoroughly documented in the ML security community and requires minimal skill to reproduce.
Arbitrary code execution in ESPnet before v.202609 is triggered when a user loads an attacker-crafted PyTorch checkpoint through any of the framework's model initialization, fine-tuning, or averaging pipelines. The root cause is CWE-502 (Deserialization of Untrusted Data): ESPnet called torch.load with weights_only=False across at least four distinct code paths, allowing pickle-embedded payloads to execute arbitrary commands with the privileges of the ESPnet process. No public exploit has been identified at time of analysis, but the attack technique - crafting malicious PyTorch pickle checkpoints - is thoroughly documented in the ML security community and requires minimal skill to reproduce.