Vendor
ESPnet versions prior to 202609 are vulnerable to arbitrary code execution due to the insecure deserialization of pretrained model checkpoints using torch.load with weights_only=False.