The CosyVoice project included an insecure deserialization flaw in its model loading routine. When a user supplies a directory via the --model_dir flag, the code calls torch.load() without enabling the safety feature weights_only=True, allowing arbitrary Python objects to be deserialized through the Pickle module. An attacker can place a maliciously crafted .pt file containing a pickle payload in the target directory; when the victim loads the directory through the web interface, the payload is executed, resulting in remote code execution on the victim's machine.

CosyVoice, version associated with commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e

The vulnerability is a classic insecure deserialization, identified as CWE‑502, and has the potential for full system compromise. No EPSS score is available, and the vulnerability is not listed in CISA KEV, but the absence of safety checks and the ability to execute arbitrary code make it a high‑severity risk. The attack vector is likely local to the web interface that accepts model directories, but any user with access to supply such a directory can trigger the exploit.