The CosyVoice project included an insecure deserialization flaw in its model loading routine. When a user supplies a directory via the --model_dir flag, the code calls torch.load() without enabling the safety feature weights_only=True, allowing arbitrary Python objects to be deserialized through the Pickle module. An attacker can place a maliciously crafted .pt file containing a pickle payload in the target directory; when the victim loads the directory through the web interface, the payload is executed, resulting in remote code execution on the victim's machine.

CosyVoice, version associated with commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e

The vulnerability is a classic insecure deserialization flaw, classified as CWE‑502, and can lead to system‑wide compromise. The CVSS score of 8.8 categorizes it as high severity. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation. It is not listed in CISA KEV. Because the code deserializes arbitrary Python objects from user‑supplied .pt files via torch.load() without the security‑restrictive weights_only=True parameter, an attacker can trigger remote code execution by placing a malicious payload in a model directory that a victim loads through CosyVoice’s web interface. The attack vector appears local to the web interface accepting model directories, but anyone who can supply such a directory can exploit the flaw.