VulnSocial

CVE-2026-90777General

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or fine-tuning path.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-13: 2Patch / Workaround · 2026-09-13: 1Technical Details · 2026-09-13: 109-13
Signal classification2 categories
General
150.0%
Patch
150.0%
Referenced assets4 URLs
Full discourse2 posts
  • devestacion ⚡️@devestacion
    Patch

    espnet today. cve-2026-90777. pretrained checkpoints were loading with torch.load and weights_only=false. one bad .pt file runs code on your box. fixed in 202609. you still loading mystery checkpoints? https://www.thehackerwire.com/espnet-rce-via-malicious-model-deserialization/

    Post summary

    The tweet discloses CVE-2026-90777 as an RCE vulnerability in espnet via malicious PyTorch checkpoint deserialization and notes it is fixed in version 202609, making the primary focus the availability of a patch.

    0000039
    273 followersView on X
  • PeritumAI@peritumAI
    General

    https://github.com/espnet/espnet/security/advisories/GHSA-64f6-3gqc-r926 https://nvd.nist.gov/vuln/detail/CVE-2026-90777 https://github.com/espnet/espnet/releases/tag/v.202609

    Post summary

    The text only lists URLs associated with a CVE, GitHub advisory, NVD record, and release. It provides no substantive vulnerability, exploitation, remediation, or PoC details.

    0000046
    287 followersView on X

Explore more

Back to dashboard