Log in Start free

Vulnerability · Published May 25, 2025 · Assigned by VulDB

CVE-2025-5148FunAudioLLM InspireMusic Pickle Data model.py load_state_dict deserialization

Medium 5.3

In plain English

A medium-severity unsafe deserialization in InspireMusic from FunAudioLLM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 89.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function load_state_dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. An attack has to be approached locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 784cbf8dde2cf1456ff808aeba23177e1810e7a9. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIinspiremusicno fix listedGHSA-pgp9-g5q8-j3wp
PyPIinspiremusicno fix listedPYSEC-2026-1464

Affected products (as reported)

VendorProductVersions
FunAudioLLM InspireMusic bf32364bcb0d136497ca69f9db622e9216b029dd

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References