PT-2025-22859 · Unknown · Funaudiollm Inspiremusic

Ybdesire · Published 2025-05-25 · Updated 2025-05-25 · CVE-2025-5148

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd

Description A critical issue was found in the function load state dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. This issue leads to deserialization and can be exploited locally.

Recommendations Apply the patch 784cbf8dde2cf1456ff808aeba23177e1810e7a9 to fix this issue. As a temporary workaround, consider disabling the load state dict function until the patch is applied.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2025-5148

GHSA-PGP9-G5Q8-J3WP

Affected Products

Funaudiollm Inspiremusic

References · 13

• https://github.com/FunAudioLLM/InspireMusic/commit/784cbf8dde2cf1456ff808aeba23177e1810e7a9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-5148 · Security Note
• https://osv.dev/vulnerability/GHSA-pgp9-g5q8-j3wp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-5148 · Vendor Advisory
• https://github.com/FunAudioLLM/InspireMusic/issues/53#issuecomment-2866688220 · Note
• https://github.com/FunAudioLLM/InspireMusic · Note
• https://github.com/FunAudioLLM/InspireMusic/issues/53 · Note
• https://vuldb.com/?submit.573800 · Note
• https://vuldb.com/?id.310236 · Note
• https://twitter.com/CVEnew/status/1926615749646258392 · Twitter Post
• https://t.me/cvenotify/123556 · Telegram Post
• https://t.me/cvetracker/24597 · Telegram Post
• https://vuldb.com/?ctiid.310236 · Note