CosyVoice’s average_model.py contains an insecure deserialization flaw. The script loads PyTorch checkpoint files with torch.load() without setting weights_only=True, allowing pickle to deserialize arbitrary Python objects. This flaw turns the model‑averaging process into an arbitrary code execution vector when a malicious checkpoint file is present in the directory being processed.

The vulnerability affects the CosyVoice repository at commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e. Any deployment of the average_model.py script that processes checkpoints in a directory is susceptible, regardless of the scale of model averaging. No other third‑party vendors are listed.

The CVSS score of 7.3 indicates high risk, and the EPSS score of <1% reflects that exploitation is unlikely but plausible. The vulnerability is not listed in the CISA KEV catalog. Because an attacker can supply a malicious checkpoint file to the average_model.py script, any run of the tool with untrusted input allows arbitrary code execution. The exploit path requires the attacker to place the malicious checkpoint in the directory processed by the tool; no additional privileges are needed beyond executing the script.