CVE-2025-27779highCWE-502

CVE-2025-27779: falha de alta gravidade em IAHispano Applio

Applio allows unsafe deserialization in model_blender.py

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Applio

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.9epss 0.9%
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `model_blender.py` lines 20 and 21. `model_fusion_a` and `model_fusion_b` from voice_blender.py take user-supplied input (e.g. a path to a model) and pass that value to the `run_model_blender_script` and later to `model_blender` function, which loads these two models with `torch.load` in `model_blender.py (on lines 20-21 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available on the `main` branch of the Applio repository.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
IAHispano · Applio
CVEs relacionadas — IAHispano Applio

No mesmo produto, das mais perigosas para as menos.

CVE-2025-27782HIGHApplio allows arbitrary file write in inference.pyEPSS 1.4%CVE-2025-27783HIGHApplio allows arbitrary file write in train.pyEPSS 1.1%CVE-2025-27778HIGHApplio allows unsafe deserialization in infer.pyEPSS 1.0%CVE-2025-27781HIGHApplio allows unsafe deserialization in inference.pyEPSS 0.9%CVE-2025-27780HIGHApplio allows unsafe deserialization in model_information.pyEPSS 0.9%CVE-2025-27787HIGHApplio allows a DoS in restart.pyEPSS 0.8%