CosyVoice uses torch.load() to import model weight files without enabling the security‑restrictive weights_only=True flag, permitting arbitrary Python objects to be deserialized through the pickle module. An attacker can craft a malicious model directory containing specially crafted files that, when loaded by the CosyVoice Web UI, execute arbitrary code on the victim’s system.

The vulnerability exists in CosyVoice builds up to and including commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025‑30‑21). Systems running CosyVoice without applying a newer commit that enables weights_only=True are impacted.

The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.7 indicates moderate severity. However, the impact remains high because execution of arbitrary code is possible whenever a user loads a model from a directory controlled by a malicious actor. The risk remains significant, and the exploitability is likely high when the CosyVoice Web UI is accessible in an environment where an attacker can supply a model directory.