Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
openbmb/voxcpm
main @ 856d2fc
2
Fixes
0
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Arbitrary Code Execution: 1 prior fix. Scrutinize any change in this area.
src/voxcpm/core.py: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Arbitrary Code Execution: Loading unsafe LoRA checkpoints using torch.load without restricting serialized classes can allow attackers to execute arbitrary code via malicious pickle payloads. Safe deserialization must be enforced everywhere model weights are loaded.
Denial of Service: Failing to validate input types before calling string operations like text.strip() can trigger unhandled AttributeErrors, leading to application crashes and denial of service.