CVE-2026-31250: CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera

CosyVoice, a voice synthesis tool, has a vulnerability in its model averaging feature where it loads PyTorch checkpoint files (serialized machine learning model files) using an unsafe method that can execute arbitrary code. An attacker can create malicious checkpoint files that, when processed by the tool, will run code on the victim's computer without permission.