Applio Unsafe Deserialization Vulnerability in Voice Conversion Tool Allowing Remote Code Execution

A vulnerability allowing unsafe deserialization has been identified in Applio, a voice conversion tool, in versions through 3.2.8-bugfix. The issue resides in the 'infer.py' file, where user-supplied input is deserialized without proper validation. This vulnerability can be exploited to execute arbitrary code remotely.

Impact

Exploitation of this vulnerability allows for remote code execution on the server running Applio.

Reproduction

The vulnerability can be reproduced by uploading a malicious model file through the application's inference or TTS (text-to-speech) tabs. The 'infer.py' script will then deserialize the model file using 'torch.load', executing any embedded code.

Remediation

A fix for this vulnerability is available on the main branch of the Applio repository, but it has not yet been included in a numbered release.