CosyVoice through commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e contains an insecure deserialization vulnerability (CWE-502) in average_model.py. The script loads PyTorch checkpoint files (epoch_*.pt) using torch.load() without the weights_only=True parameter, which is necessary to prevent deserialization of arbitrary Python objects via pickle. This allows an attacker to craft malicious checkpoint files that, when loaded by the tool during model averaging, execute arbitrary code on the victim's system. The vulnerability is remotely exploitable without privileges or user interaction and has a CVSS 3.1 score of 7.3 (high).

Successful exploitation results in arbitrary code execution on the victim's system when the vulnerable model averaging tool loads malicious checkpoint files. This can lead to confidentiality, integrity, and availability impacts, including potential system compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading untrusted or unauthenticated PyTorch checkpoint files with the average_model.py tool. Applying the weights_only=True parameter in torch.load() calls is recommended to mitigate the risk of arbitrary code execution.