CosyVoice’s data processing tool make_parquet_list.py performs insecure deserialization by loading PyTorch .pt files with torch.load() without setting the secure parameter weights_only=True, exposing the pickle module to arbitrary Python object reconstruction (CWE‑502). When a malicious .pt file is deserialized, the pickle payload can execute arbitrary code in the context of the user running the tool, leading to full system compromise.

All CosyVoice users who run make_parquet_list.py on directories containing untrusted .pt files and are still using the codebase up to commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (released 2025‑30‑21). No specific vendors are listed; the risk applies to any deployment of the affected version.

An attacker can trigger the flaw by placing a crafted .pt file in a data directory processed by the script. Local or application‑controlled file system write access is required to supply the malicious file. The CVSS score of 7.3 indicates a high severity; the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. Although the vulnerability is not yet in the CISA KEV catalog, the potential for arbitrary code execution warrants prompt remediation.