Insecure Deserialization in PyTorch Model Averaging Tools

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its average_model.py model averaging tool. The script loads PyTorch checkpoint files (epoch_*.pt) for model averaging using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing malicious checkpoint files within a directory. When a victim uses the tool to average models from this directory, arbitrary code is executed on the victim's system.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CosyVoice's model averaging utility contains a critical insecure deserialization flaw in its average_model.py script. The vulnerability stems from unsafe use of torch.load() when processing PyTorch checkpoint files (epoch_*.pt), which relies on Python's pickle module to reconstruct objects without the weights_only=True safeguard. This allows attackers to inject arbitrary Python code through malicious checkpoint files, enabling remote code execution when developers or ML practitioners run the model averaging process. The impact is significant because model averaging is a common operation in machine learning workflows, and many security teams may not realize that loading seemingly benign model files can trigger code execution. Anyone using CosyVoice versions through commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e is affected, particularly those in research, development, or production ML environments where untrusted model artifacts might be processed.

Casky's 419 mapped skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability across MITRE ATT&CK's Initial Access (TA0001), Resource Development (TA0043), and Execution (TA0002) phases. Practitioners using Casky would see detection signals around suspicious object deserialization patterns, unexpected process spawning during model loading operations, and anomalous file access patterns when checkpoint files are processed. The platform's Claude-powered analysis would flag unsafe torch.load() calls in code repositories, identify instances where pickle-serialized objects are instantiated without validation, and correlate these findings with known exploitation patterns. Security teams would receive contextual insights into how attackers could weaponize model checkpoints through supply chain compromise, and recommendations to enforce weights_only=True parameters and implement checkpoint validation procedures before deserialization.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-31250.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-31250

Casky has 419 skills that investigate the attack patterns behind CVE-2026-31250. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn