Insecure Deserialization in CosyVoice Speech Model Loading

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its gRPC server component. When the server starts, it loads the speech synthesis model from a user-specified directory using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing malicious model files within a directory. When a victim starts the gRPC server pointing to this directory, arbitrary code is executed on the victim's system during server initialization.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CosyVoice contains a critical insecure deserialization vulnerability in its gRPC server that exploits unsafe model loading through PyTorch's torch.load() function. When the server initializes, it deserializes speech synthesis models from user-specified directories without enabling the weights_only=True parameter, allowing attackers to inject malicious pickle-serialized Python objects. This vulnerability affects any organization deploying CosyVoice for speech synthesis applications—particularly those processing untrusted model files or accepting model uploads from external sources. The attack requires local or network access to place malicious model files in the target directory, but once exploited, provides arbitrary code execution with the privileges of the gRPC server process.

Casky's 301 matched skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across the Resource Development (TA0001) and Reconnaissance (TA0043) attack lifecycle stages. Practitioners would identify suspicious model loading sequences, unauthorized file placement in model directories, and gRPC service initialization with untrusted inputs as key indicators. The platform maps detection patterns to CWE-502 (Deserialization of Untrusted Data) and related weaknesses, enabling security teams to recognize when threat actors probe for vulnerable torch.load() implementations, attempt to stage malicious serialized objects, or establish persistence through compromised model files. Automated analysis would flag unsafe deserialization patterns in deployment configurations and model management workflows, surfacing risks before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-31251.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-31251

Casky has 301 skills that investigate the attack patterns behind CVE-2026-31251. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn