CVE-2026-79784

Name of the Vulnerable Software and Affected Versions Vocos (affected versions not specified)

Description The software instantiates classes based on a configuration file without restricting which classes can be named. The instantiate class function in vocos/pretrained.py uses the class path value from the configuration to import a module via import and resolve an attribute using getattr, subsequently calling the result as args class(*args, **kwargs) with arguments from the init args mapping. Because there is no allowlist to constrain the dotted path, a configuration file can specify any importable callable and its arguments. This issue is reachable through Vocos.from hparams for feature extractor, backbone, and head entries, as well as through Vocos.from pretrained, which downloads a config.yaml from a specified Hugging Face repository. Consequently, loading a model from an untrusted repository allows the repository owner to execute arbitrary code during the loading process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.