Executive Summary

This vulnerability is an insecure deserialization issue in CosyVoice's average_model.py tool. The tool loads PyTorch checkpoint files using torch.load() without enabling the weights_only=True parameter, which means it deserializes the entire object using Python's pickle module. Because pickle can execute arbitrary code during deserialization, an attacker can craft malicious checkpoint files that, when loaded by the tool, execute arbitrary code on the victim's system.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker can execute arbitrary code on your system by tricking the model averaging tool into loading malicious checkpoint files. This could lead to unauthorized actions such as data theft, system compromise, or further malware installation, depending on the attacker's intent and the privileges of the user running the tool.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid using the average_model.py tool to load PyTorch checkpoint files from untrusted or unverified directories.

Ensure that when using torch.load() in the model averaging tool, the weights_only=True parameter is enabled to prevent insecure deserialization.

Additionally, review and validate all checkpoint files before processing them with the tool to avoid executing malicious code.

Useful 0 Not Useful 0