Vocos: model config can name any importable class, so from_pretrained runs the repo owner's code

Impact

instantiate_class takes a dotted class_path straight out of the model configuration, imports it and calls it with arguments the same config supplies, with no allowlist on what may be named. Vocos.from_hparams hits this for the feature_extractor, backbone and head entries, and Vocos.from_pretrained reaches it with a config.yaml downloaded from whatever Hugging Face repository the caller names. Loading a Vocos model from a repository you do not control therefore executes the repository owner's code inside the loading process - the inference or training worker itself, with its GPU devices, mounted datasets, service account and any API tokens in its environment. The advisory notes the neighbouring torch.load is already constrained on PyTorch builds that default weights_only to true, which leaves this config path as the reachable one, so a hardened torch version does not cover it.

Who can reach it

No network position needed: the attacker publishes or takes over a Hugging Face repository. Exploitation requires a user or pipeline on the fleet to load a model from it (CVSS UI:A) - an automated model-pull job counts.

What to do

The record identifies no fixed version; it points to an open upstream issue and the VulnCheck advisory, so treat this as mitigate-only for now. Load Vocos checkpoints only from repositories you control or have mirrored and reviewed, inspect config.yaml class_path values before loading, and pin the model revision rather than tracking a remote head. Where models must come from third parties, run the load in a sandbox that has no credentials and no access to other tenants' data. Track the upstream issue for a release that constrains the dotted path.

References

Related entries

• iFlytek astron-agent: copyFlow lacks an ownership check, letting any tenant read or overwrite workflowsCVE-2026-82475 · iFlytek astron-agent (console backend copyFlow workflow endpoint)High
• Unsloth Zoo: model config.json injects Python that runs via exec() when a model is loadedCVE-2026-93348 · Unsloth / Unsloth Zoo (get_transformers_model_type model-loading compile path)High
• Ollama: agent-mode Bash approval does not parse shell syntax, so appended commands run unapprovedCVE-2026-102697 · Ollama experimental agent mode (Bash tool approval parser, x/agent/approval.go)High
• AWS databases-on-aws agent plugin: crafted database command in agent context runs OS commands on the hostCVE-2026-107322 · Amazon Agent Plugins for AWS, databases-on-aws plugin (agent command helper)High
• BentoML: newline in docker.env keys injects Dockerfile instructions during bentoml containerizeCVE-2026-112264 · BentoML (containerize, legacy base.j2 Dockerfile template)High
• Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High