Applio allows unsafe deserialization in inference.py
Applio 3.2.7 contained an unsafe deserialization vulnerability in inference.py that could allow remote code execution when loading untrusted model files. GitHub Security Lab reported the issue, and the maintainers released a fix on 2025-02-01 by adding the weights_only parameter to torch.load() calls.
What happened
Applio version 3.2.7 is vulnerable to unsafe deserialization in inference.py where torch.load() is called without the weights_only parameter set to True. GitHub Security Lab reported the vulnerability CVE-2025-27781 as part of a broader set of vulnerabilities GHSL-2024-341 through GHSL-2024-353.
The vulnerability allows an attacker to supply a malicious model file that would be deserialized, potentially allowing remote code execution. The issue was identified in the get_speakers_id function in tabs/inference/inference.py at line 337.
Reported impact
The unsafe deserialization vulnerability could allow an attacker to execute arbitrary code on systems running Applio when loading a specially crafted model file.
Index analysis
The vulnerability stems from use of torch.load() without restricting deserialization to weights only, which is a known attack vector in PyTorch-based applications when processing untrusted model files.
Governance controls
GitHub Security Lab coordinated disclosure with the Applio maintainers starting 2024-12-11. The fix was released on 2025-02-01, adding weights_only=True parameter to torch.load() calls in inference.py and train.py.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.