The CosyVoice project contains an insecure deserialization vulnerability (CWE-502) in its model loading mechanism. Specifically, when loading model files from a directory specified by the user via the --model_dir argument, the code calls torch.load() without the weights_only=True parameter. This omission allows arbitrary Python objects to be deserialized through the Pickle module embedded in .pt files. An attacker can exploit this by supplying a malicious model directory with crafted .pt files. When these files are loaded through the CosyVoice web interface, the embedded pickle payload executes, leading to remote code execution on the victim's machine. The vulnerability was introduced in a commit dated 2025-30-21 and was published on 2026-05-12. There is no CVSS score or vendor advisory available, and no patch or mitigation has been confirmed.

Successful exploitation results in remote code execution on the victim's system when malicious model files are loaded. This can lead to full compromise of the affected system. There are no known exploits in the wild at this time. The vulnerability affects all versions of CosyVoice that use the vulnerable model loading code and accept user-supplied model directories.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading model files from untrusted or user-supplied directories. Restricting access to the model loading functionality or disabling the --model_dir argument may reduce risk. Monitoring vendor channels for updates is recommended.