A critical arbitrary code execution vulnerability in ESPnet allows attackers to compromise systems by providing malicious model checkpoint files.

The vulnerability exists due to the use of unsafe deserialization (CWE-502) in the load_pretrained_model function, where torch.load is called with weights_only=False. This enables an unauthenticated attacker to execute arbitrary code during the initialization or fine-tuning process if they can supply a malicious checkpoint file.

The ability to achieve remote code execution poses a severe threat to system integrity and confidentiality. By leveraging this flaw, an attacker could gain full control over the application environment, potentially leading to unauthorized data access, lateral movement within the network, or total system compromise. Given the CVSS score of 8.8, this vulnerability represents a high-risk entry point for malicious actors targeting deep learning infrastructure.

Immediate Action: Update the ESPnet software to version 202609 or later to implement the required security constraints on model loading.

Proactive Monitoring: Monitor system logs for unexpected file access patterns or execution requests originating from the model initialization and fine-tuning modules.

Compensating Controls: Restrict the ability of external or untrusted users to upload or supply model checkpoint files to the application. Ensure that all loaded model files originate from verified and trusted sources to prevent the introduction of malicious payloads.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to any environment utilizing ESPnet for model training or inference. Organizations should prioritize upgrading to the patched version immediately to eliminate the underlying deserialization risk. Failure to apply this update leaves the application susceptible to full system compromise through the loading of manipulated checkpoint files.