Executive brief
ESPnet is an open-source speech processing toolkit used to build automatic speech recognition and text-to-speech systems. The toolkit loads pre-trained model checkpoints during initialization and fine-tuning without validation, allowing attackers who can supply malicious checkpoint files to execute arbitrary code on systems running ESPnet. This could lead to complete system compromise, data theft, or malware installation.
Technical details
ESPnet uses PyTorch's torch.load() function with weights_only=False to deserialize pre-trained model checkpoints, enabling arbitrary Python object instantiation during deserialization. The vulnerable code path affects model initialization and fine-tuning workflows where checkpoint files are loaded from attacker-controlled or untrusted sources. An attacker can craft malicious checkpoint files that execute code at deserialization time, bypassing the application's normal logic. No authentication or special privileges are required—only the ability to provide or intercept a checkpoint file. Patches should enable weights_only=True in torch.load() calls or implement cryptographic integrity verification for checkpoint files.
Affected products
- ESPnet ESPnet before 202609
Timeline
- 2026-09-13: disclosed