Unsafe Deserialization in ESPnet Model Checkpoint Loading

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or fine-tuning path.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ESPnet, a popular open-source end-to-end speech processing toolkit, contains a critical deserialization vulnerability in how it loads pretrained model checkpoints. The vulnerability stems from using torch.load() with weights_only=False, which permits arbitrary Python code execution during the deserialization process. Attackers can craft malicious checkpoint files that execute code when loaded through model initialization or fine-tuning workflows. This affects researchers, ML engineers, and organizations using ESPnet for speech recognition, synthesis, or related tasks, particularly those who download or receive checkpoints from untrusted sources. With a CVSS score of 8.8, this represents a high-severity risk for supply chain attacks targeting machine learning pipelines.

Casky's 447 matched skills enable detection of this attack pattern by leveraging Claude's extended reasoning across three critical MITRE ATT&CK techniques: Initial Access (TA0001) — identifying malicious checkpoint files as entry vectors; Execution (TA0043) — flagging arbitrary code execution during deserialization; and Persistence (TA0002) — detecting suspicious post-execution behaviors. Practitioners using Casky would see findings highlighting unsafe deserialization patterns in model loading code, suspicious checkpoint file origins, and runtime indicators of code execution outside expected model inference paths. The platform's 754 mapped skills enable comprehensive detection of the attack chain, from checkpoint acquisition through payload execution, helping security teams identify compromised model sources before they're deployed in production speech processing systems.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90777.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-90777

Casky has 447 skills that investigate the attack patterns behind CVE-2026-90777. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn