The CosyVoice gRPC server contains an insecure deserialization flaw. When the server starts, it loads a speech synthesis model from a user‑specified directory using torch.load() without setting the weights_only=True security flag. Because torch.load() deserializes arbitrary Python objects via the pickle module, an attacker can place malicious model files in that directory. During server startup the payload is executed, giving the attacker arbitrary code execution on the victim’s machine. This flaw involves insecure deserialization, which aligns with CWE‑20, CWE‑915, and CWE‑94, and results in full compromise of the host system.

The affected product is the CosyVoice project hosted on GitHub. The vulnerability exists in commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (dated 2025‑30‑21). Users running the gRPC server with a model directory that can be controlled by an attacker are impacted. No other vendors or versions are currently listed as affected.

The EPSS score is < 1% and the vulnerability has a CVSS score of 7.3. The vulnerability is not listed in CISA’s KEV catalog. The exploit requires the victim to start the gRPC server pointing to a directory that an attacker can place malicious files in. An attacker who can influence the model path – for example by compromising a configuration file or a locally running user – can trigger the payload. The risk rises if the server is exposed to untrusted input or used in an environment where users can specify the model directory, thereby allowing local code execution during initialization.