CVE-2026-79784 Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration
Attackers can execute arbitrary code by providing a malicious configuration file that specifies unrestricted class paths for instantiation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-79784?
CVE-2026-79784 is a high-severity code injection vulnerability in gemelo-ai vocos, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls the result as args_class(*args, **kwargs) where kwargs is the config's own init_args mapping. No allowlist constrains the dotted path, so a configuration may name any importable callable and supply the arguments it is called with. Vocos.from_hparams reaches this for each of the feature_extractor, backbone and head entries, and Vocos.from_pretrained reaches it with a remote file: it downloads config.yaml from a caller-named Hugging Face repository and passes it straight to from_hparams. Loading a model from a repository the user does not control therefore executes code of the repository owner's choosing in the loading process. The neighbouring torch.load of the downloaded weights is a separate matter and is constrained on PyTorch releases that default weights_only to true, which leaves this path as the reachable one.
Weakness: CWE-470
Which versions are affected by CVE-2026-79784?
How do I fix CVE-2026-79784?
No fix has been published for CVE-2026-79784 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-79784 being exploited?
There is no known exploitation of CVE-2026-79784 in the wild and no public exploit code.
Sources
Also known as GHSA-697j-x98h-3qgg.