17 matches found
CVE-2026-112086
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
EUVD-2026-104089
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
CVE-2026-112086 ESPnet Inference Model inference_model.py build_model deserialization
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
CVE-2026-112086 ESPnet Inference Model inference_model.py build_model deserialization
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
CVE-2026-112086
A vulnerability exists in ESPnet up to version 202610.post2 within the Inference Model Handler component. Specifically, the build_model function in the file espnet3/publication/inference_model.py is susceptible to deserialization due to the manipulation of the _target_ argument. This flaw can be ...
CVE-2026-112086 ESPnet Inference Model inference_model.py build_model deserialization
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
PT-2026-117233
A vulnerability was found in ESPnet up to 202610.post2. This affects the function build model of the file espnet3/publication/inference model.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack...
CVE-2026-112086: Deserialization of Untrusted Data
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
CVE-2026-90777
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
EUVD-2026-77001
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
CVE-2026-90777 ESPnet before 202609 Remote Code Execution via Unsafe Deserialization
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
dataoceanai-dolphin (>=20250317.0.0, <=20250716.0.0), espnet-model-zoo (>=0.0.0a1, <=0.1.1a2) +3 more potentially affected by CVE-2026-90777 via espnet (>=202301.0.0, <=202511.0.0)
espnet PYPI version =202301.0.0, =20250317.0.0, =0.0.0a1, =0.0.1, =6.0.1, =6.0.2 Source cves: CVE-2026-90777 Source advisory: MEND:CVE-2026-90777...
CVE-2026-90777 ESPnet before 202609 Remote Code Execution via Unsafe Deserialization
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
CVE-2026-90777 ESPnet before 202609 Remote Code Execution via Unsafe Deserialization
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
CVE-2026-90777
ESPnet before v.202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, enabling arbitrary code execution from attacker-supplied files. The vulnerable code path is triggered when a malicious checkpoint file is loaded through the model initialization or fine-tuni...
PT-2026-90848
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization o...
CVE-2026-90777: Deserialization of Untrusted Data
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...