{"data":{"id":"54f82632-b70d-4bd4-b46d-402621bb7cd2","title":"CVE-2025-27780: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in…","summary":"CVE-2025-27780 affects Applio, a voice conversion tool, in versions 3.2.8-bugfix and prior. User-supplied input for `model_name` in model_information.py is passed through `run_model_information_script` to the `model_information` function, which loads the model with `torch.load` at rvc/train/process/model_information.py (line 16 in 3.2.8-bugfix). Because this call is unsafe, the flaw can lead to remote code execution.","solution":"A patch is available in the `main` branch of the repository.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-27780","publishedAt":"2025-03-19T21:15:39.980Z","cveId":"CVE-2025-27780","cweIds":["CWE-502"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Applio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Applio unsafe deserialization in model information loading","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00923,"epssCheckedAt":"2026-11-04T06:10:14.970Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-28T18:09:49.654Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability","safety"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}