Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

funaudiollm/cosyvoice

              main @ 074ca6d
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Arbitrary Code Execution: 1 prior fix. Scrutinize any change in this area.

cosyvoice/cli/model.py: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: Insecure deserialization via torch.load allows arbitrary code execution when loading untrusted model checkpoints or metadata files, unless explicitly restricted with weights_only=True. This vector is tracked across multiple published CVEs affecting various entry points.

Denial of Service: A resource leak within the request cache tracking mechanism in CosyVoiceModel could lead to memory exhaustion and denial of service if finished request UUIDs are not popped from flow_cache_dict.