espnet CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH espnet CVE published 2026-09-13

CVE-2026-90777

CVE-2026-90777 is a high-severity vulnerability in ESPnet, a popular open-source toolkit for end-to-end speech processing. The vulnerability arises from the insecure deserialization of pretrained model checkpoints using torch.load with weights_only=False. This allows attackers to craft malicious checkpoint files that can execute arbitrary code when loaded through the initialization or fine-tuning path.