20 matches found
CVE-2026-112086
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
CVE-2026-112086
A vulnerability exists in ESPnet up to version 202610.post2 within the Inference Model Handler component. Specifically, the build_model function in the file espnet3/publication/inference_model.py is susceptible to deserialization due to the manipulation of the _target_ argument. This flaw can be ...
CVE-2026-112086 ESPnet Inference Model inference_model.py build_model deserialization
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
EUVD-2026-104089
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
CVE-2026-112086 ESPnet Inference Model inference_model.py build_model deserialization
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
CVE-2026-112086 ESPnet Inference Model inference_model.py build_model deserialization
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
CVE-2026-112086
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
CVE-2026-112086: Deserialization of Untrusted Data
A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...
PT-2026-117233
A vulnerability was found in ESPnet up to 202610.post2. This affects the function build model of the file espnet3/publication/inference model.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack...
ESPNET input validation error vulnerability
The espnet 202610.post2 and earlier versions have a security vulnerability. This vulnerability stems from incorrect handling of the target parameter in the buildmodel function found in the file ESPnet3/publication/inferencemodel.py. It may lead to deserialization, and attackers could exploit this...
CVE-2026-90777
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
EUVD-2026-77001
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
CVE-2026-90777 ESPnet before 202609 Remote Code Execution via Unsafe Deserialization
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
CVE-2026-90777 ESPnet before 202609 Remote Code Execution via Unsafe Deserialization
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
CVE-2026-90777 ESPnet before 202609 Remote Code Execution via Unsafe Deserialization
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
CVE-2026-90777
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
dataoceanai-dolphin (>=20250317.0.0, <=20250716.0.0), espnet-model-zoo (>=0.0.0a1, <=0.1.1a2) +3 more potentially affected by CVE-2026-90777 via espnet (>=202301.0.0, <=202511.0.0)
espnet PYPI version =202301.0.0, =20250317.0.0, =0.0.0a1, =0.0.1, =6.0.1, =6.0.2 Source cves: CVE-2026-90777 Source advisory: MEND:CVE-2026-90777...
CVE-2026-90777
ESPnet before v.202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, enabling arbitrary code execution from attacker-supplied files. The vulnerable code path is triggered when a malicious checkpoint file is loaded through the model initialization or fine-tuni...
CVE-2026-90777: Deserialization of Untrusted Data
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...
PT-2026-90848
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization o...