CVE-2026-31249

The open-source voice generation platform CosyVoice (up to commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e) is vulnerable to an insecure deserialization vulnerability (CWE-502 ) in its make_parquet_list.py data processing tool. The flaw exists because the script uses torch.load() to process PyTor...