CVE-2026-90777: Espnet

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or fine-tuning path.

Affected products

• Espnet Espnet: before 202609 (fixed in 202609)

Published 2026-09-13. Last modified 2026-09-23.