CVE-2025-27779

Date: March 19, 2025

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in "model_blender.py" lines 20 and 21. "model_fusion_a" and "model_fusion_b" from voice_blender.py take user-supplied input (e.g. a path to a model) and pass that value to the "run_model_blender_script" and later to "model_blender" function, which loads these two models with "torch.load" in "model_blender.py (on lines 20-21 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available on the "main` branch of the Applio repository.