CVE-2026-79784
Received Received - Intake

Arbitrary Code Execution in Vocos Pretrained Model Loading

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls the result as args_class(*args, **kwargs) where kwargs is the config's own init_args mapping. No allowlist constrains the dotted path, so a configuration may name any importable callable and supply the arguments it is called with. Vocos.from_hparams reaches this for each of the feature_extractor, backbone and head entries, and Vocos.from_pretrained reaches it with a remote file: it downloads config.yaml from a caller-named Hugging Face repository and passes it straight to from_hparams. Loading a model from a repository the user does not control therefore executes code of the repository owner's choosing in the loading process. The neighbouring torch.load of the downloaded weights is a separate matter and is constrained on PyTorch releases that default weights_only to true, which leaves this path as the reachable one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79784
EUVD
EUVD-2026-65542

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gemelo-ai vocos 0.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to execute arbitrary code when a user loads a model from a Hugging Face repository. The issue is in the Vocos library where configuration files can specify any importable callable, leading to unintended code execution during model loading.

Detection Guidance

To detect this vulnerability, inspect Python environments for the vocos package version 0.1.0 or earlier. Check for suspicious YAML configurations in pretrained model repositories that use dynamic class_path imports. Monitor network traffic for unexpected module imports or code execution during model loading.

Impact Analysis

If you load a model from an untrusted Hugging Face repository, an attacker could execute malicious code on your system with the same privileges as your user account. This could lead to data theft, system compromise, or further network attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected systems may face compliance violations and legal penalties.

Mitigation Strategies

Avoid loading models from untrusted Hugging Face repositories or configuration files. Only use models from verified sources and inspect configuration files before loading. Update PyTorch to versions that default to weights_only=true to limit additional risks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79784. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart