CosyVoice versions up to commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e contain an insecure deserialization vulnerability (CWE-502) in their gRPC server. The vulnerability arises because the server loads speech synthesis models using torch.load() without the weights_only=True flag, allowing arbitrary Python objects to be deserialized via pickle. If an attacker can place malicious model files in the directory specified at server startup, arbitrary code can be executed on the victim system during initialization of the gRPC server.

Successful exploitation results in arbitrary code execution on the victim system during gRPC server startup. This can lead to full system compromise depending on the privileges of the server process. The attack requires the attacker to supply malicious model files and influence the directory path used by the server, limiting remote exploitation scenarios. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid starting the gRPC server with model directories that could be controlled or influenced by untrusted users. Restrict access to model directories and validate inputs specifying model paths. Consider running the server with least privilege to limit impact of potential exploitation.