PT-2025-22859 · Unknown · Funaudiollm Inspiremusic

Ybdesire · CVE-2025-5148 · Published 2025-05-25 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd

Description A critical issue was found in the function load state dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. This issue leads to deserialization and can be exploited locally.

Recommendations Apply the patch 784cbf8dde2cf1456ff808aeba23177e1810e7a9 to fix this issue. As a temporary workaround, consider disabling the load state dict function until the patch is applied.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2025-5148

GHSA-PGP9-G5Q8-J3WP

PYSEC-2026-1464

Affected Products

Funaudiollm Inspiremusic

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5148.json · Exploit
• https://github.com/FunAudioLLM/InspireMusic/commit/784cbf8dde2cf1456ff808aeba23177e1810e7a9 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-1464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5148 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5148 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pgp9-g5q8-j3wp · Vendor Advisory
• https://github.com/FunAudioLLM/InspireMusic/issues/53 · Note
• https://github.com/FunAudioLLM/InspireMusic · Note
• https://github.com/FunAudioLLM/InspireMusic/issues/53#issuecomment-2866688220 · Note
• https://vuldb.com/?id.310236 · Note
• https://vuldb.com/?ctiid.310236 · Note
• https://twitter.com/CVEnew/status/1926615749646258392 · Twitter Post
• https://pypi.org/project/inspiremusic · Note
• https://vuldb.com/?submit.573800 · Note
• https://github.com/advisories/GHSA-pgp9-g5q8-j3wp · Note