{"data":{"id":"e489c27e-f1fc-46a5-a8d5-ca4919fb7b33","title":"CVE-2025-27779: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in…","summary":"Applio versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `model_blender.py` on lines 20 and 21. The `model_fusion_a` and `model_fusion_b` inputs from `voice_blender.py`, which can be a user-supplied model path, reach `torch.load` without safe handling, and the issue can lead to remote code execution.","solution":"A patch is available on the `main` branch of the Applio repository.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-27779","publishedAt":"2025-03-19T21:15:39.850Z","cveId":"CVE-2025-27779","cweIds":["CWE-502"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Applio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Applio unsafe deserialization in model blending via torch.load","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00923,"epssCheckedAt":"2026-11-04T18:09:14.469Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-28T18:09:49.936Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability","safety"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}