Executive brief
Vocos is a neural vocoder library used for audio synthesis. The library's model loading functions (`from_hparams` and `from_pretrained`) instantiate arbitrary Python classes named in configuration files without validation. An attacker who controls a model repository can craft a malicious config file to execute arbitrary code when a user loads the model, leading to complete system compromise.
Technical details
The vulnerability exists in the `instantiate_class()` function in vocos/pretrained.py, which uses `__import__()` and `getattr()` to dynamically load and instantiate classes based on a `class_path` value read directly from a YAML configuration file. The function accepts no allowlist or validation of which classes may be instantiated. The `from_pretrained()` method downloads a config.yaml from a Hugging Face repository and passes it directly to `from_hparams()` without sanitization. An attacker controlling a model repository can therefore supply a config file naming any importable callable (e.g., `os.system`) with arbitrary arguments, achieving remote code execution during model loading. This attack vector is reached before PyTorch's `weights_only` safeguard can apply to the subsequent `torch.load()` call.
Affected products
- Gemelo AI Vocos <UNKNOWN>
Timeline
- 2026-08-25: disclosed