CVE-2026-79784: Vocos Arbitrary Code Execution Vulnerability

CVE-2026-79784 Overview

CVE-2026-79784 is an unsafe class instantiation vulnerability in Vocos, a neural vocoder library distributed via PyPI. The flaw lives in instantiate_class inside vocos/pretrained.py, which resolves a class_path string from a YAML configuration file and calls it with attacker-supplied init_args. Because no allowlist restricts the dotted path, any importable Python callable can be invoked with arbitrary arguments. Vocos.from_pretrained reaches this code path after downloading config.yaml from a caller-named Hugging Face repository, turning model loading from an untrusted repository into arbitrary code execution [CWE-470].

Critical Impact
Loading a Vocos model from an attacker-controlled Hugging Face repository executes code chosen by the repository owner in the loading process.

Affected Products

Vocos (gemelo-ai/vocos) neural vocoder library
Vocos PyPI package
Applications invoking Vocos.from_pretrained or Vocos.from_hparams

Discovery Timeline

2026-08-25 - CVE-2026-79784 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79784

Vulnerability Analysis

Vocos parses a YAML configuration file that names three components: feature_extractor, backbone, and head. For each entry, instantiate_class reads class_path, splits it on the final dot, imports the module with __import__, resolves the attribute with getattr, and calls the resulting object with **init_args from the same config. The library performs no validation on which module or callable can be named.

An attacker who controls the configuration therefore controls both the callable and its arguments. Reachable targets include os.system, subprocess.Popen, builtins.exec, or any importable function that produces a side effect. Vocos.from_pretrained amplifies the impact: it downloads config.yaml directly from a Hugging Face repository named by the caller and passes it unmodified to from_hparams. A user who loads Vocos.from_pretrained("attacker/repo") executes attacker code during model loading.

The advisory notes that the neighboring torch.load call is a separate risk surface, mitigated on PyTorch releases where weights_only defaults to true. That change leaves the class-instantiation path as the reachable one.

Root Cause

The root cause is unsafe reflection [CWE-470]. The library treats configuration data as trusted metadata and resolves arbitrary dotted class paths without an allowlist, type check, or subclass constraint against expected Vocos component base classes.

Attack Vector

An attacker publishes a Hugging Face repository containing a crafted config.yaml. When a victim calls Vocos.from_pretrained against that repository, the malicious class_path and init_args are executed in the victim's Python process with the victim's privileges. Exploitation requires user action to load the model but no authentication against the attacker's repository.

Refer to the VulnCheck Security Advisory and the Vocos pretrained.py source for the vulnerable code path.

Detection Methods for CVE-2026-79784

Indicators of Compromise

Unexpected child processes spawned by Python interpreters that recently invoked Vocos.from_pretrained or Vocos.from_hparams.
config.yaml files containing class_path values pointing to modules outside vocos.*, such as os, subprocess, builtins, or posix.
Outbound network connections from ML training or inference hosts to previously unseen Hugging Face repositories.
New files, cron entries, or SSH keys created shortly after a Vocos model load event.

Detection Strategies

Statically scan cached Hugging Face repository contents and local YAML configs for class_path entries that do not resolve into the vocos package.
Instrument Python environments to log __import__ calls originating from vocos.pretrained.instantiate_class and alert on non-allowlisted modules.
Correlate process ancestry telemetry to flag shells, interpreters, or network utilities spawned as children of Python processes loading ML models.

Monitoring Recommendations

Monitor endpoint EDR telemetry for Python parent processes launching sh, bash, cmd.exe, powershell.exe, or curl during model load windows.
Track egress from data science workstations and GPU nodes to huggingface.co repositories not present on an approved list.
Log and review all installations and upgrades of the vocos PyPI package across build agents and researcher endpoints.

How to Mitigate CVE-2026-79784

Immediate Actions Required

Restrict Vocos.from_pretrained usage to Hugging Face repositories that your organization owns or has vetted.
Inspect every config.yaml before loading and reject any class_path that does not resolve to a known Vocos component class.
Run model loading in an isolated, network-restricted sandbox or container with no access to production credentials or secrets.
Audit CI/CD, notebook, and inference environments for historical loads of untrusted Vocos repositories and rotate any credentials that were exposed.

Patch Information

No fixed version is identified in the referenced advisory at publication. Track the upstream Vocos repository and GitHub Issue #76 for remediation progress. Until an upstream fix ships, treat all Vocos model loads from third-party sources as untrusted code execution.

Workarounds

Fork Vocos and modify instantiate_class to enforce an allowlist of permitted class_path prefixes, such as vocos.feature_extractors, vocos.models, and vocos.heads.
Replace Vocos.from_pretrained calls with manual downloads followed by explicit validation of config.yaml against a schema.
Pin trusted model artifacts internally and block outbound traffic from ML hosts to arbitrary Hugging Face repositories at the network egress layer.
Execute untrusted model loads inside ephemeral containers with dropped capabilities, read-only filesystems, and no outbound network access.

bash

# Example allowlist check before loading a Vocos config
grep -E '^\s*class_path:' config.yaml | \
  grep -vE 'class_path:\s*vocos\.(feature_extractors|models|heads)\.' && \
  echo "Untrusted class_path detected - refusing to load" && exit 1