A vulnerability in Vocos 0.1.0 allows an attacker to execute arbitrary code during model loading because the library accepts a class_path string from a configuration file and performs an unrestricted import of the specified class (CWE‑470). The instantiate_class function splits the path into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls it with configuration arguments, all without limiting which classes may be referenced. This lack of validation permits the execution of any Python object available to the runtime, effectively turning the model configuration file into an attacker‑controlled code injection vector.

Gemelo‑AI Vocos up through version 0.1.0 is affected. Any installation that imports the package and invokes Vocos.from_hparams or Vocos.from_pretrained to load a model from a repository that the user does not control is vulnerable. The issue resides in the model configuration handling of these functions and was present in releases before the 0.1.1 update, if available.

The CVSS score of 8.6 indicates a high severity of the flaw. Because no EPSS score is available, the exploitation probability cannot be quantified, but the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a compromised or malicious model repository that supplies a crafted config.yaml containing a harmful class_path entry; loading such a model with Vocos.from_pretrained triggers the execution of the attacker‑supplied code during the loading process. If the attacker can supply the repository name, they control the configuration file and thereby the code executed on the host. No publicly reported exploit exists yet, but the presence of unrestricted imports means that any arbitrary code can be executed, presenting a significant risk if a user loads models from unknown sources.