Crucially, the library fails to implement an allowlist to restrict which classes or functions can be instantiated. The Vocos.from_pretrained method allows users to load models from Hugging Face repositories, which triggers the download of a config.yaml file. Because this file is passed directly to the vulnerable from_hparams method, an attacker who controls a Hugging Face repository can point the configuration to any importable Python callable on the victim's system, resulting in arbitrary code execution during the model loading process.

Impact

Successful exploitation allows for full arbitrary code execution under the privileges of the Python process loading the malicious model. This impacts data scientists and machine learning engineers using Vocos to load models from third-party or public repositories. Attackers can leverage this to gain persistence or access sensitive data within the environment where the model is being loaded.

Recommendation

• Audit all internal model loading workflows to ensure that Vocos models are only loaded from trusted, verified sources.
• Implement strict network egress filtering for servers processing machine learning models to prevent unauthorized downloads from untrusted Hugging Face repositories.
• If possible, wrap the Vocos model loading process in a sandboxed or containerized environment with restricted filesystem and network access.
• Monitor for Python processes using the vocos library that are initiating unexpected outbound network connections, particularly to unknown or non-official Hugging Face repository domains.