{"data":{"id":"ade649fd-f71c-4148-ba73-921d51d08365","title":"CVE-2026-112086: A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file…","summary":"A vulnerability in ESPnet up to 202610.post2 affects the build_model function in espnet3/publication/inference_model.py, part of the Inference Model Handler component. Manipulating the _target_ argument leads to deserialization, and the attack can be launched remotely. A public exploit exists.","solution":"The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112086","publishedAt":"2026-10-19T06:17:23.667Z","cveId":"CVE-2026-112086","cweIds":["CWE-20","CWE-502"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ESPnet"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ESPnet deserialization flaw in build_model via _target_ argument","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-19T12:09:18.092Z","kevDateAdded":null,"advisoryAliases":["GHSA-v5q2-hr9p-q4jv"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-19T12:09:20.837Z","patchAvailable":null,"disclosureDate":"2026-10-19T06:17:23.667Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}