CVE-2026-79784

Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

No known exploitation. EPSS puts it in the 47th percentile. No fix published yet.

CVSS 3.18.8High EPSS percentile47th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-08-25Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Gemelo-ai VocosAffected: ≤ 0.1.0Upgrade to: after 0.1.0Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls the result as args_class(*args, **kwargs) where kwargs is the config's own init_args mapping. No allowlist constrains the dotted path, so a configuration may name any importable callable and supply the arguments it is called with. Vocos.from_hparams reaches this for each of the feature_extractor, backbone and head entries, and Vocos.from_pretrained reaches it with a remote file: it downloads config.yaml from a caller-named Hugging Face repository and passes it straight to from_hparams. Loading a model from a repository the user does not control therefore executes code of the repository owner's choosing in the loading process. The neighbouring torch.load of the downloaded weights is a separate matter and is constrained on PyTorch releases that default weights_only to true, which leaves this path as the reachable one.

In plain language

Written by AI from the record

Vocos can run malicious code just by loading a model’s configuration from a repository; a typical small business should worry if you download and load models you didn’t create yourself.

CVE-2026-79784 is an arbitrary code execution issue in vocos caused by loading an unrestricted Python class path from a model configuration (configuration-driven class import/instantiation), enabling attackers to execute commands when a crafted model config is fetched and loaded.

If you're affected

Full system compromise
Malicious command execution
Data theft risk
Service disruption

What is it

Vocos loads a “model configuration” that tells it what code to import and run. If someone can get you to load a malicious configuration (for example, by pointing to a model repository), that configuration can trigger arbitrary commands on your machine—like swapping the instructions in a recipe so the kitchen ends up doing something dangerous.

Who is affected

This matters if your business uses vocos to download and load models from a repository or configuration file you don’t fully control. The risk is tied to the loading step: the attacker’s payload is delivered through the model configuration you load.
Only a risk if the model/config can be influenced by an attacker (for example, you download from untrusted or attacker-controlled repositories, or your workflow fetches model configs based on untrusted input).

How urgent is it

This is a high-risk weakness because it allows arbitrary command execution without requiring login. There’s no known public exploit code in the information we have, and it is not listed in CISA KEV, but the attack can be triggered just by loading a malicious model configuration—so you should treat it as urgent if you fetch models from outside you control.

What to do — in detail

Confirm exposure in your environment:
- Identify everywhere your workflow uses vocos to load models (both local files and any remote downloads).
- Pay special attention to any step that fetches a model configuration (for example, a config.yaml) from a repository.
- Determine whether the repository/model name or the resulting configuration is influenced by users, integrations, third-party scripts, or any dynamic input.
Determine whether you can be attacked:
- If you only load models you created or models you have reviewed and stored internally, the practical risk is much lower.
- If you download models/configurations from external repositories that you do not fully control (or where the model choice is not tightly fixed), you must assume a malicious configuration could be loaded.
Mitigate immediately (temporary workaround while waiting for a patch):
- Stop downloading/loading model configurations from untrusted repositories.
- Enforce a strict allowlist of approved model configs and repository sources (ideally internal storage of the exact config files).
- If the business requires multiple models, restrict selection to a pre-approved set controlled by your system (not user input).
Patch / fix tracking:
- Current information provides no fixed version or patch details for CVE-2026-79784. Contact your software vendor/maintainers or check release notes specifically for CVE-2026-79784 and “class_path”/configuration loading hardening.
What to monitor:
- Monitor for unexpected process launches or command executions during model loading.
- Review logs for model repository/config download events, and alert on downloads from new/unrecognized sources.

Technical context

Severity is high (CVSS 8.8). Mechanism: unrestricted loading of a Python class path from a model configuration, using it to import and instantiate callables without an allowlist (CWE-470). Attack vector is network-connected through the model-loading workflow: vocos can download a remote model configuration and then instantiate the class named by that configuration; if the configuration points to attacker-controlled code, arbitrary commands can run in the context of the process. Authentication is not required, but a victim action is required: loading a model/configuration file (including configs pulled from a repository). Exploit maturity: no public exploit code is on record; no KEV listing from CISA in the provided findings. EPSS is a prediction only (and is not treated as confirmed exploitation). No fixed version is available from the provided patch information.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS47th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 47th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 30 days, from the signal feeds we watch.

2026-09-24Record updated
2026-08-26Record updated
2026-08-25Publishedweakness classified, att&ck mapped, record updated

Affected products

gemelo-ai
- vocos

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-470No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

ExecutionT1059Command and Scripting Interpreterhigh confidence

Sources

References in the record

And 2 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Vocos, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account