Arbitrary Code Execution in ESPnet via Insecure Deserialization

ESPnet versions prior to 202609 contain a critical vulnerability in the handling of pretrained model checkpoints. The software utilizes the Python 'torch.load' function with the 'weights_only' parameter set to 'False'. By design, 'torch.load' relies on Python's 'pickle' module for deserialization. When 'weights_only' is disabled, the pickle process can instantiate arbitrary objects and execute embedded code within the checkpoint file. An attacker can create a weaponized checkpoint file and trick a user or system into loading it during the initialization or fine-tuning process of an ESPnet model. This flaw allows an attacker to achieve remote code execution in the context of the user or process running the ESPnet toolkit, potentially leading to full system compromise.

Impact

Successful exploitation allows for arbitrary code execution on systems running ESPnet. Given the nature of machine learning workflows, this poses a risk to research environments, data processing pipelines, and production inference systems where untrusted model checkpoints may be ingested. If exploited, an attacker could gain persistent access, exfiltrate sensitive model data, or pivot within the host network.

Recommendation

• Upgrade all instances of ESPnet to version 202609 or later immediately to address the insecure deserialization flaw.
• Implement strict validation and provenance checks for all pretrained model checkpoints before loading them into the ESPnet framework.
• Execute machine learning model processing within isolated containers or restricted environments to minimize the impact of potential command execution.
• Monitor the Python process execution logs for unexpected child processes spawned by model initialization scripts.