Vocos: model config can name any importable class, so from_pretrained runs the repo owner's code

Impact

instantiate_class takes a dotted class_path straight out of the model configuration, imports it and calls it with arguments the same config supplies, with no allowlist on what may be named. Vocos.from_hparams hits this for the feature_extractor, backbone and head entries, and Vocos.from_pretrained reaches it with a config.yaml downloaded from whatever Hugging Face repository the caller names. Loading a Vocos model from a repository you do not control therefore executes the repository owner's code inside the loading process - the inference or training worker itself, with its GPU devices, mounted datasets, service account and any API tokens in its environment. The advisory notes the neighbouring torch.load is already constrained on PyTorch builds that default weights_only to true, which leaves this config path as the reachable one, so a hardened torch version does not cover it.

Who can reach it

No network position needed: the attacker publishes or takes over a Hugging Face repository. Exploitation requires a user or pipeline on the fleet to load a model from it (CVSS UI:A) - an automated model-pull job counts.

What to do

The record identifies no fixed version; it points to an open upstream issue and the VulnCheck advisory, so treat this as mitigate-only for now. Load Vocos checkpoints only from repositories you control or have mirrored and reviewed, inspect config.yaml class_path values before loading, and pin the model revision rather than tracking a remote head. Where models must come from third parties, run the load in a sandbox that has no credentials and no access to other tenants' data. Track the upstream issue for a release that constrains the dotted path.

References

Related entries

• Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High
• NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
• Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
• skops (`Card.get_model`): Model card loading has no trusted-types checkCVE-2025-54886 · skops (`Card.get_model`)High
• mcp-shell: allowlist validates only the first token, so /bin/bash -c runs any commandCVE-2026-55581 · mcp-shell (security.go command allowlist, /bin/bash -c handling)High
• mcp-shell: allowed git binary runs arbitrary commands via a `!` alias, bypassing secure modeCVE-2026-55582 · mcp-shell (security.go shell-metacharacter checks, git alias handling)High