CVE-2026-90777

ESPnet before version 202609 loads pretrained model checkpoints with PyTorch's torch.load using weights_only=False, which deserializes arbitrary Python objects rather than only tensor weights. An attacker who convinces a user to load a crafted checkpoint file — for example one shared via a model hub, forum, or direct link — can execute arbitrary code on the victim's machine the moment the file is loaded through ESPnet's initialization or fine-tuning path. Successful exploitation gives full code execution with the privileges of the user running the training or inference job, compromising the host and any data or credentials accessible to it. The flaw affects any user of ESPnet releases prior to 202609 who loads model files that did not originate from a fully trusted source. No public proof-of-concept is known, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Upgrade to ESPnet 202609 or later, where checkpoints are loaded with weights_only restrictions enforced. Until upgraded, only load checkpoint files (.pth/.pt) from sources you fully trust, verify file hashes against official releases, and never load models received from unverified links or third-party model repositories. Consider running model loading in an isolated container or sandbox to limit the blast radius of a malicious checkpoint.