CosyVoice Insecure Deserialization Vulnerability Leading to Remote Code Execution

A vulnerability allowing insecure deserialization has been identified in the CosyVoice project, specifically in the model loading process. This issue arises in versions prior to the latest commit on March 16, 2026. The vulnerability allows the deserialization of arbitrary Python objects through the Pickle module, which can be exploited by providing maliciously crafted model files (.pt) embedded with pickle payloads. When these files are loaded from a user-specified directory via the web interface, the embedded payloads are executed, resulting in remote code execution on the user's system.

Impact

Exploitation of this vulnerability allows for remote code execution on the victim's system.

Reproduction

To reproduce this vulnerability, upload a malicious .pt file containing a pickle payload to a directory. Then, use the CosyVoice web interface to load the model from that directory. The malicious payload will be executed, leading to remote code execution.