The CosyVoice project contains an insecure deserialization vulnerability (CWE-502) in its model loading mechanism. Specifically, when loading model files from a user-specified directory via the --model_dir argument, the code calls torch.load() without the security-restrictive weights_only=True parameter. This omission permits deserialization of arbitrary Python objects through Pickle embedded in .pt files. An attacker can exploit this by supplying a crafted model directory containing malicious .pt files. When these files are loaded via CosyVoice's web interface, the embedded payload executes, resulting in remote code execution on the victim system. The vulnerability is publicly known as CVE-2026-31232 with a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

Successful exploitation leads to remote code execution on the victim's system when a malicious model file is loaded. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without privileges but requires user interaction to load the malicious model directory. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid loading model files from untrusted or unauthenticated sources. Implement manual validation or sandboxing of model files before loading. Monitor official CosyVoice channels for updates or patches addressing this insecure deserialization issue.