ESPnet vulnerabilities
CVEs whose affected-version data names the ESPnet package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-112086Medium· 6.3PoCESPnet Inference Model inference_model.py build_model deserialization
A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results …
▾ TwilightEPSS 0.32%via CVEORG
CVE-2026-90777High· 8.8PoCESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files
ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code dur…
▾ Midnightespnet · espnetEPSS 0.73%via NVD