PT-2025-22859 · Unknown · Funaudiollm Inspiremusic

Ybdesire · Publicado 2025-05-25 · Atualizado 2025-05-25 · CVE-2025-5148

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd

Description A critical issue was found in the function load state dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. This issue leads to deserialization and can be exploited locally.

Recommendations Apply the patch 784cbf8dde2cf1456ff808aeba23177e1810e7a9 to fix this issue. As a temporary workaround, consider disabling the load state dict function until the patch is applied.

Correção

RCE

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-20

CWE-502

Identificadores relacionados

CVE-2025-5148

GHSA-PGP9-G5Q8-J3WP

Produtos afetados

Funaudiollm Inspiremusic

Referências · 13

• https://github.com/FunAudioLLM/InspireMusic/issues/53#issuecomment-2866688220 · Nota
• https://github.com/FunAudioLLM/InspireMusic/commit/784cbf8dde2cf1456ff808aeba23177e1810e7a9 · Correção
• https://github.com/FunAudioLLM/InspireMusic · Nota
• https://github.com/FunAudioLLM/InspireMusic/issues/53 · Nota
• https://vuldb.com/?submit.573800 · Nota
• https://vuldb.com/?id.310236 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-5148 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-pgp9-g5q8-j3wp · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-5148 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1926615749646258392 · Publicação no Twitter
• https://t.me/cvenotify/123556 · Publicação no Telegram
• https://t.me/cvetracker/24597 · Publicação no Telegram
• https://vuldb.com/?ctiid.310236 · Nota