CVE-2026-79784: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in gemelo-ai vocos
Description
Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls the result as args_class(*args, **kwargs) where kwargs is the config's own init_args mapping. No allowlist constrains the dotted path, so a configuration may name any importable callable and supply the arguments it is called with. Vocos.from_hparams reaches this for each of the feature_extractor, backbone and head entries, and Vocos.from_pretrained reaches it with a remote file: it downloads config.yaml from a caller-named Hugging Face repository and passes it straight to from_hparams. Loading a model from a repository the user does not control therefore executes code of the repository owner's choosing in the loading process. The neighbouring torch.load of the downloaded weights is a separate matter and is constrained on PyTorch releases that default weights_only to true, which leaves this path as the reachable one.
CVSS v4.0
Score 8.6high
Affected software
gemelo-ai
vocos
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability occurs in vocos/pretrained.py where the function instantiate_class uses a class_path value from a configuration file to dynamically import and instantiate classes without any allowlist or validation. The configuration can specify any importable callable and its initialization arguments. The function Vocos.from_pretrained downloads a config.yaml from a user-supplied Hugging Face repository and passes it directly to from_hparams, which calls instantiate_class. This means loading a model from an untrusted repository leads to execution of arbitrary code during the loading process. The related torch.load call is constrained by PyTorch defaults and is not the primary risk vector here.
Potential Impact
An attacker controlling the configuration file in a remote repository can execute arbitrary code on the system loading the model. This can lead to full compromise of the environment where vocos is used, including unauthorized code execution and potential data compromise. The vulnerability requires no privileges and can be triggered by loading a model from a malicious repository, making it a significant remote code execution risk.
Mitigation Recommendations
No official patch or fix is currently documented. Users should avoid loading models from untrusted or unknown repositories until a fix is available. Restricting or validating configuration inputs to allow only known safe classes is recommended as a temporary mitigation. Monitor vendor advisories for official fixes or updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-25T14:32:37.762Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8dba57acd9273b4965b6ca
Added to database: 08/25/2026, 15:52:55 UTC
Last enriched: 09/25/2026, 02:42:33 UTC
Last updated: 10/08/2026, 18:48:49 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.