Remote Code Execution Vulnerability in ESPnet by ESPnet

CVE-2026-90777

What is CVE-2026-90777?

The vulnerability involves ESPnet's handling of pretrained model checkpoints, where using the torch.load function with weights_only set to false leads to unsafe deserialization. This flaw permits attackers to craft malicious checkpoint files that execute arbitrary code during the model loading process, particularly during initialization or fine-tuning. Ensuring security requires updating to ESPnet version 202609 or later, as previous versions are susceptible to this critical denial of control for the executing environment.

References