CVE-2026-90777

Name of the Vulnerable Software and Affected Versions ESPnet versions prior to 202609

Description Insecure deserialization occurs when pretrained model checkpoints are loaded using the torch.load function with the weights only variable set to False. This allows arbitrary code execution if an attacker provides a specially crafted malicious checkpoint file. The issue can be triggered during the initialization or fine-tuning path, potentially granting an attacker full control over the system running the software.

Recommendations Update to version 202609.