Description
A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference/thirdparty/cosyvoice/cli/model.py. The manipulation leads to deserialization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Xorbits | Inference | 1.4.0, 1.4.1 | — |
References
- VDB-304679 | Xorbits Inference model.py load deserialization vdb-entry technical-description mitigation
- VDB-304679 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #552245 | xorbitsai inference 0.15.0 to 1.4.1 Deserialization third-party-advisory
- https://github.com/xorbitsai/inference/issues/3190 issue-tracking
- https://github.com/xorbitsai/inference/issues/3190#issuecomment-2783462266 issue-tracking mitigation