Description

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or fine-tuning path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-13T12:17:16.690Z",
  "pubdate": "2026-09-13T12:17:16.690Z",
  "executiveSummary": "ESPnet versions prior to 202609 contain a critical arbitrary code execution vulnerability stemming from insecure deserialization of pretrained model checkpoints.\nThe vulnerability arises because the application utilizes the torch.load function with weights_only=False, which allows for the execution of arbitrary Python code embedded within serialized PyTorch model files.\nThis flaw impacts all systems utilizing ESPnet for model loading, fine-tuning, or initialization, posing a high-risk security threat.\nAn attacker can exploit this by providing a maliciously crafted checkpoint file. When the application processes this file, the underlying PyTorch deserialization mechanism executes the attacker-controlled instructions.\nSuccessful exploitation grants the attacker the capability to execute arbitrary code with the same privileges as the user or service running the ESPnet process.\nThis vulnerability is particularly dangerous in environments where users may load untrusted or externally sourced pretrained models, facilitating remote code execution (RCE) scenarios without requiring prior authentication or specialized network access.",
  "technicalDetails": "The root cause of this vulnerability is the insecure use of the pickle module via torch.load in PyTorch, specifically when the weights_only argument is set to False (or defaults to False in older versions).\nWhen torch.load is invoked without strict restrictions, PyTorch attempts to reconstruct complex Python objects by executing the underlying bytecode stored within the file.\nAn attacker can manipulate a serialized checkpoint file by injecting a custom Python class instance with a __reduce__ method. This method is used by the pickle module to define how the object should be reconstructed during deserialization.\nThe exploit flow follows a deterministic sequence: 1) The attacker constructs a malicious file formatted as a valid PyTorch checkpoint, incorporating a payload within the pickle data stream. 2) The target ESPnet application is triggered to load this model file via its standard model initialization or fine-tuning APIs. 3) The application calls torch.load(file_path, weights_only=False). 4) As the deserialization process initiates, the Python interpreter executes the instructions defined in the attacker's __reduce__ method, bypassing standard object instantiation and executing arbitrary code.\nThe vulnerable component resides within the model loading subsystem of ESPnet, which handles the ingestion of external binary model weights. Because these functions are often exposed to user-uploaded files or external model repositories, the attack vector is highly reachable.\nAffected versions include all ESPnet distributions prior to the 202609 release. The vulnerability does not require authentication to exploit if the application provides a public or semi-public interface for model uploading or loading, and it does not necessitate elevated system privileges, as the code executes within the context of the application runtime.\nPost-exploitation impact includes full system compromise, unauthorized data exfiltration, and the establishment of persistent backdoors within the victim's computational environment. Since this occurs during the deserialization phase, the code executes before any validation of the model's structure or layer parameters, rendering traditional model integrity checks ineffective."
}