CVE-2026-90777: ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitr

ESPnet (a speech processing AI framework) before version 202609 has a vulnerability where it loads pretrained model checkpoints (saved AI model files) using an unsafe method that can execute hidden malicious code. An attacker can create a fake checkpoint file that runs whatever code they want when someone tries to use that file to initialize or improve an AI model.