{"data":{"id":"19b89aa0-489f-4d7e-9840-b6406beef2f2","title":"CVE-2025-27781: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in…","summary":"CVE-2025-27781 affects Applio, a voice conversion tool, in versions 3.2.8-bugfix and prior. User-supplied input for `model_file` in inference.py and tts.py flows through `change_choices` and `get_speakers_id` into `torch.load` at line 326 of inference.py (3.2.8-bugfix), enabling unsafe deserialization that can lead to remote code execution.","solution":"A patch is available on the `main` branch of the repository.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-27781","publishedAt":"2025-03-19T21:15:40.117Z","cveId":"CVE-2025-27781","cweIds":["CWE-502"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Applio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Applio unsafe deserialization in inference.py via model_file input","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00923,"epssCheckedAt":"2026-11-04T18:09:14.608Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-28T18:09:49.375Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}