{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/vocos/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-79784"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vocos"],"_cs_severities":["high"],"_cs_tags":["arbitrary-code-execution","machine-learning","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Vocos"],"content_html":"\u003cp\u003eThe Vocos library, primarily used for audio synthesis tasks, contains a critical arbitrary code execution vulnerability (CVE-2026-79784) within its model loading infrastructure. The vulnerability exists in the \u003ccode\u003einstantiate_class\u003c/code\u003e function located in \u003ccode\u003evocos/pretrained.py\u003c/code\u003e. This function reads a \u003ccode\u003eclass_path\u003c/code\u003e from a configuration file, dynamically imports the specified module using \u003ccode\u003e__import__\u003c/code\u003e, retrieves the attribute via \u003ccode\u003egetattr\u003c/code\u003e, and executes the resulting callable using arguments provided in the configuration's \u003ccode\u003einit_args\u003c/code\u003e mapping.\u003c/p\u003e\n\u003cp\u003eCrucially, the library fails to implement an allowlist to restrict which classes or functions can be instantiated. The \u003ccode\u003eVocos.from_pretrained\u003c/code\u003e method allows users to load models from Hugging Face repositories, which triggers the download of a \u003ccode\u003econfig.yaml\u003c/code\u003e file. Because this file is passed directly to the vulnerable \u003ccode\u003efrom_hparams\u003c/code\u003e method, an attacker who controls a Hugging Face repository can point the configuration to any importable Python callable on the victim's system, resulting in arbitrary code execution during the model loading process.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full arbitrary code execution under the privileges of the Python process loading the malicious model. This impacts data scientists and machine learning engineers using Vocos to load models from third-party or public repositories. Attackers can leverage this to gain persistence or access sensitive data within the environment where the model is being loaded.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all internal model loading workflows to ensure that Vocos models are only loaded from trusted, verified sources.\u003c/li\u003e\n\u003cli\u003eImplement strict network egress filtering for servers processing machine learning models to prevent unauthorized downloads from untrusted Hugging Face repositories.\u003c/li\u003e\n\u003cli\u003eIf possible, wrap the Vocos model loading process in a sandboxed or containerized environment with restricted filesystem and network access.\u003c/li\u003e\n\u003cli\u003eMonitor for Python processes using the \u003ccode\u003evocos\u003c/code\u003e library that are initiating unexpected outbound network connections, particularly to unknown or non-official Hugging Face repository domains.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-25T18:10:16Z","date_published":"2026-08-25T18:10:16Z","id":"https://feed.craftedsignal.io/briefs/2026-08-vocos-rce/","summary":"The Vocos library contains an arbitrary code execution vulnerability in its configuration loading process that allows attackers to execute arbitrary Python callables when loading models from untrusted repositories.","title":"Arbitrary Code Execution in Vocos via Unrestricted Class Instantiation","url":"https://feed.craftedsignal.io/briefs/2026-08-vocos-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Vocos","version":"https://jsonfeed.org/version/1.1"}