CosyVoice through commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e contains an insecure deserialization vulnerability (CWE-502) in its model loading component. The framework uses torch.load() to load model weight files without enabling the weights_only=True parameter, which restricts deserialization to tensor weights only. This omission allows deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a malicious model directory containing specially crafted model files. When the victim starts the CosyVoice Web UI pointing to this directory, arbitrary code execution occurs during model loading. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating local attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation results in arbitrary code execution on the victim's system during the model loading process, potentially compromising confidentiality, integrity, and availability to a limited extent. The attack requires local access and user interaction to load the malicious model directory. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid loading model files from untrusted or unauthenticated sources. Consider manually inspecting or sandboxing model loading operations to mitigate risk.