CVE-2025-27781: falha de alta gravidade em IAHispano Applio
Applio allows unsafe deserialization in inference.py
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.9epss 0.9%
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in inference.py. `model_file` in inference.py as well as `model_file` in tts.py take user-supplied input (e.g. a path to a model) and pass that value to the `change_choices` and later to `get_speakers_id` function, which loads that model with `torch.load` in inference.py (line 326 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available on the `main` branch of the repository.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
IAHispano · ApplioCVEs relacionadas — IAHispano Applio
No mesmo produto, das mais perigosas para as menos.
CVE-2025-27782HIGHApplio allows arbitrary file write in inference.pyEPSS 1.4%CVE-2025-27783HIGHApplio allows arbitrary file write in train.pyEPSS 1.1%CVE-2025-27778HIGHApplio allows unsafe deserialization in infer.pyEPSS 1.0%CVE-2025-27779HIGHApplio allows unsafe deserialization in model_blender.pyEPSS 0.9%CVE-2025-27780HIGHApplio allows unsafe deserialization in model_information.pyEPSS 0.9%CVE-2025-27787HIGHApplio allows a DoS in restart.pyEPSS 0.8%
Referências
https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/inference/inference.py#L325https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/inference/inference.py#L338-L345https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/tts/tts.py#L50-L57https://github.com/IAHispano/Applio/commit/eb21d9dd349a6ae1a28c440b30d306eafba65097https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/