CVE-2026-31249

The open-source voice generation platform CosyVoice (up to commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e) is vulnerable to an insecure deserialization flaw (CWE-502) in its make_parquet_list.py data processing tool. The script uses torch.load() to process PyTorch .pt files (containing utterance...