CosyVoice up to 2025-30-21 Pickle torch.load --model_dir deserialization

Summaryinfo

A vulnerability was found in CosyVoice up to 2025-30-21. It has been rated as critical. The affected element is the function torch.load of the component Pickle Module. Performing a manipulation of the argument --model_dir results in deserialization. This vulnerability is reported as CVE-2026-31232. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in CosyVoice up to 2025-30-21. It has been classified as critical. This affects the function torch.load of the component Pickle Module. The manipulation of the argument --model_dir with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its model loading process. When loading model files (.pt) from a user-specified directory (via the --model_dir argument), the code uses torch.load() without the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the Pickle module. An attacker can exploit this by providing a maliciously crafted model directory containing .pt files with embedded pickle payloads. When a victim loads this directory using CosyVoice's web interface, the malicious payload is executed, leading to remote code execution on the victim's system.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-31232 since 03/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/12/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• CosyVoice

Version

• 2025-30-21

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion