Arbitrary Code Execution Risk in Vocos by Gemelo AI

CVE-2026-79784

What is CVE-2026-79784?

Vocos, developed by Gemelo AI, is susceptible to an arbitrary code execution vulnerability due to the way it handles model configurations. The library permits the instantiation of any class defined in a configuration file without a proper allowlist, enabling potential attackers to specify arbitrary callables through a 'class_path'. This process includes importing modules and executing their respective attributes unsafely using user-defined parameters. By leveraging this vulnerability, attackers can manipulate the configuration to execute malicious code from untrusted sources, particularly when loading model configurations directly from external repositories like Hugging Face. This poses a significant risk for users of Vocos, especially when configuring feature extractors and backbone components.

References