CVE-2026-79784: Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

Published Aug 25, 2026
·
Updated

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with getattr, and calls the result as argsclass(args, kwargs) where kwargs is the config's own initargs mapping. No allowlist constrains the dotted path, so a configuration may name any importable callable and supply the arguments it is called with. Vocos.fromhparams reaches this for each of the featureextractor, backbone and head entries, and Vocos.frompretrained reaches it with a remote file: it downloads config.yaml from a caller-named Hugging Face repository and passes it straight to fromhparams. Loading a model from a repository the user does not control therefore executes code of the repository owner's choosing in the loading process. The neighbouring torch.load of the downloaded weights is a separate matter and is constrained on PyTorch releases that default weightsonly to true, which leaves this path as the reachable one.

Affected Software

1 affected component
Vocos<=0.1.0

Event History

Aug 25, 2026
CVE Published
via MITRE·03:16 PM
Data Sourced
via MITRE·03:16 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who is exposed to this issue?

Any user or service that loads Vocos model configuration from an untrusted source is exposed. In particular, Vocos.from_pretrained downloads config.yaml from a caller-selected Hugging Face repository and processes it without restricting the configured class paths.

2

What does an attacker need to exploit it?

An attacker needs to cause a target to load a model configuration they control, such as by convincing them to use an attacker-controlled Hugging Face repository. No authentication or pre-existing privileges are required, but the target must perform the model-loading action.

3

Are default Vocos model-loading paths affected?

Yes. Vocos.from_pretrained reaches the vulnerable configuration handling after downloading config.yaml, and Vocos.from_hparams processes the feature_extractor, backbone, and head configuration entries. The issue is independent of the neighboring weight-loading behavior and remains reachable even where PyTorch defaults torch.load to weights_only=true.

4

What can be done if patching is not immediately possible?

Do not load models or configuration files from repositories or other sources you do not control. Restrict model loading to trusted, reviewed configurations and repositories until a fix that constrains permitted class paths is available.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203