CVE-2026-79784 gemelo-ai CVE debrief

Who should care

Defenders responsible for deploying and managing machine learning models using Vocos should assess their exposure and take steps to verify the authenticity of model configurations.

Why it matters

Defenders should prioritize verifying the authenticity of model configurations and ensuring that only trusted models are loaded to prevent arbitrary code execution.

• Arbitrary code execution via unrestricted class path in model configuration
• Potential for remote code execution
• Need for verification of model configuration authenticity

Technical summary

Vocos instantiates a class named by a configuration file without restricting which class may be named, allowing for arbitrary code execution. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls the result as args_class(*args, **kwargs) where kwargs is the config's own init_args mapping. No allowlist constrains the dotted path, so a configuration may name any importable callable and supply the arguments it is called with.

Defensive priority

Defenders should prioritize verifying the authenticity of model configurations and ensuring that only trusted models are loaded.

Recommended defensive actions

• Verify the authenticity of model configurations
• Ensure that only trusted models are loaded
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate that Vocos instantiates a class named by a configuration file without restricting which class may be named, allowing for arbitrary code execution. The vulnerability allows for arbitrary code execution via unrestricted class path in model configuration. The neighbouring torch.load of the downloaded weights is a separate matter and is constrained on PyTorch releases that default weights_only to true, which leaves this path as the reachable one. There is no allowlist constrains the dotted V.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.