| Titre | ESPnet espnet up to 202610.post2 (latest PyPI release); git master @ bc6dd4a also verified Insecure Deserialization |
|---|
| Description | A vulnerability was found in espnet up to 202610.post2 (latest PyPI release) and classified as high 8.8. Affected is the espnet3.publication.InferenceModel.from_packed/from_pretrained loader and the InferenceProvider.build_model component of the espnet3 publication subsystem. The manipulation of the hydra _target_ fields inside a publication bundle's conf/inference.yaml leads to insecure deserialization (arbitrary invocation of callables already installed in the victim environment). It is possible to launch the attack remotely; user interaction is required because the victim must load a malicious publication bundle, e.g. a model downloaded from a model hub via from_pretrained or a directory opened by the bundled Gradio demo, with trust_user_code at its default value of false. Verified on both the released PyPI distribution 202610.post2 and master commit bc6dd4a.
Technical Details
- Affected file/function: espnet3/publication/inference_model.py (_uses_bundled_code / from_packed) and espnet3/systems/base/inference_provider.py (build_model, line 267)
- Vulnerable parameter: nested hydra _target_/_args_ fields of conf/inference.yaml inside the publication bundle
- Attack vector: Network
- Privileges required: None
- Trigger condition: the trust_user_code gate only blocks configs whose strings reference top-level Python modules shipped inside the bundle; _target_ values resolving to stdlib/site-packages/espnet modules pass with trust_user_code=False and are handed to hydra.utils.instantiate(config.model, device=device), which recursively instantiates the attacker-chosen callables with attacker-chosen arguments (PoC demonstrates pathlib.Path.write_text writing an attacker-named file with attacker-chosen content; the same primitive reaches os.system or builtins.eval for full code execution)
Impact
- Confidentiality: High (the same primitive exposes read/exfiltration callables in the victim environment)
- Integrity: High (arbitrary file write and overwrite of any path writable by the victim account, demonstrated)
- Availability: High (arbitrary callable invocation enables destructive actions and process compromise)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-10-01
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Validate the target of every hydra _target_ at resolution time instead of only checking whether config strings mention modules bundled in the archive: resolve each _target_ and require it to come from an allowlist of known-safe builders (or from bundle modules explicitly covered by trust_user_code=True); reject or require explicit trust for targets resolving to stdlib/site-packages/espnet modules; apply the same validation on the from_pretrained model-hub path and in the Gradio demo loader. |
|---|
| La source | ⚠️ https://github.com/espnet/espnet/issues/6828 |
|---|
| Utilisateur | r1ck9 (UID 97869) |
|---|
| Soumission | 02/10/2026 13:18 (il y a 17 jours) |
|---|
| Modérer | 18/10/2026 18:12 (16 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 421831 [ESPnet jusqu’à 202610.post2 Inference Model inference_model.py build_model _target_ élévation de privilèges] |
|---|
| Points | 20 |
|---|