EUVD-2026-65542

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...

CVE-2026-79784

Vocos (through 0.1.0 ), a Python library maintained by gemelo-ai, suffers from arbitrary code execution via an unrestricted class_path field in its model configuration. The vulnerable function instantiate_class in vocos/pretrained.py uses __import__ and getattr on a user-supplied dotted path with...