CVE-2025-27780

Applio allows unsafe deserialization in model_information.py

8.9 High

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in model_information.py. model_name in model_information.py takes user-supplied input (e.g. a path to a model) and pass that value to the run_model_information_script and later to model_information function, which loads that model with torch.load in rvc/train/process/model_information.py (on line 16 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available in the main branch of the repository.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.92%Up 0.6 points since Mar 20, 2025

What each source reports

CVE List Score used 8.9

Applio allows unsafe deserialization in model_information.py

Record: CVE-2025-27780
CVSS 4.0: 8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2025-6797 8.9

Record: EUVD-2025-6797
CVSS 4.0: 8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

NVD 8.9

Record: CVE-2025-27780
CVSS 4.0: 8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 8.9

Applio allows unsafe deserialization in model_information.py

Record: CVE-2025-27780
CVSS 4.0: 8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-502
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-27780 is a high vulnerability (CVSS 8.9) in Applio, published March 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. No source names a fixed version.