CVE-2026-31250 — Unsafe torch.load in CosyVoice average_model.py checkpoint averaging

MITRE service request: 1988723

Status: RESERVED (pending a qualifying public reference per CNA Rules §5.3).

Official CVE description

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its average_model.py model averaging tool. The script loads PyTorch checkpoint files (epoch_*.pt) for model averaging using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing malicious checkpoint files within a directory. When a victim uses the tool to average models from this directory, arbitrary code is executed on the victim’s system.

Summary

Model-fusion workflows iterate epoch_*.pt checkpoints and deserialize them with unsafe torch.load. Malicious checkpoints in --src_path execute during averaging—another CosyVoice pickle gadget surface distinct from the web UI.

Affected product and versions

• Product: FunAudioLLM/CosyVoice.
• Known vulnerable commit (coordination record): 6e01309e01bc93bbeb83bdd996b1182a81aaf11e.

Technical details

• Surface: average_model.py CLI with -src_path directory of checkpoints.
• Sink: torch.load(path, map_location=torch.device('cpu')) without weights_only=True.
• Impact: RCE for ML engineers merging checkpoints from collaborators.

Risk

High — common in distributed training handoffs.

Remediation / workaround

• Vendor patch TBD; only average trusted checkpoints inside isolated VMs.

CVE Program next steps

1. §5.3.