CosyVoice through commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e contains an insecure deserialization vulnerability (CWE-502) in its average_model.py script. The tool loads PyTorch checkpoint files (epoch_*.pt) using torch.load() without the weights_only=True parameter, which is necessary to prevent deserialization of arbitrary Python objects. This flaw allows an attacker to craft malicious checkpoint files that, when loaded by the averaging tool, execute arbitrary code on the victim's system. The vulnerability affects the model averaging process and requires the victim to use the compromised checkpoint files.

Successful exploitation allows an attacker to execute arbitrary code on the victim's system during the model averaging process. This can lead to full system compromise depending on the privileges of the user running the tool. The vulnerability is triggered by loading malicious checkpoint files, which can be introduced by an attacker with write access to the directory containing the model files. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid loading untrusted or unauthenticated PyTorch checkpoint files with the average_model.py tool. Using torch.load() with the weights_only=True parameter or other secure deserialization methods is recommended once a patch or update is provided.