PT-2025-11965 · Applio+1 · Applio+1

Sylwia Budzynska

+1

·

Published

2025-03-19

·

Updated

2025-08-01

·

CVE-2025-27781

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Applio versions 3.2.8-bugfix and prior
Description Applio is a voice conversion tool. The issue concerns unsafe deserialization in the tool, specifically in the inference.py file. The model file variable in both inference.py and tts.py takes user-supplied input, which is then passed to the change choices and later to the get speakers id function. This function loads the model using torch.load, which is vulnerable to unsafe deserialization, potentially leading to remote code execution.
Recommendations For versions 3.2.8-bugfix and prior, update to a version that includes the patch available on the main branch of the repository. As a temporary workaround, consider restricting the use of the model file variable in inference.py and tts.py to minimize the risk of exploitation. Additionally, avoid using the torch.load function with untrusted input until the issue is resolved.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-27781

Affected Products

Applio
Torch