CVSS 4.0
4.8 mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NCVE-2025-5148
Medium (4.8). EPSS 0.2% chance of exploitation in the next 30 days.
A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function load_state_dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. An attack has to be approached locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 784cbf8dde2cf1456ff808aeba23177e1810e7a9. It is recommended to apply a patch to fix this issue.
Severity
CVSS 3.1
5.3 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-20, CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pgp9-g5q8-j3wp | PyPI | inspiremusic | <=0.0.1.dev0 | no fix published |
| PYSEC-2026-1464 | PyPI | inspiremusic | <=0.0.1.dev0 | no fix published |