VYPR
← All advisories
Medium severity5.3NVD Advisory· Published May 25, 2025· Updated Apr 15, 2026

CVE-2025-5148

CVE-2025-5148

Description

A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function load_state_dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. An attack has to be approached locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 784cbf8dde2cf1456ff808aeba23177e1810e7a9. It is recommended to apply a patch to fix this issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
inspiremusicPyPI
<= 0.0.1.dev0—

Patches

2
784cbf8dde2c
https://github.com/funaudiollm/funmusicvia osv
784cbf8dde2c

Update model.py

https://github.com/FunAudioLLM/InspireMusiciris2cMay 9, 2025via ghsa
commit
1 file changed · +3 −3
  • inspiremusic/cli/model.py+3 −3 modified
    @@ -81,12 +81,12 @@ def __init__(self,
 
     def load(self, llm_model, flow_model, hift_model, wavtokenizer_model):
         if llm_model is not None:
-            self.llm.load_state_dict(torch.load(llm_model, map_location=self.device))
+            self.llm.load_state_dict(torch.load(llm_model, map_location=self.device, weights_only=True))
             self.llm.to(self.device).to(self.dtype).eval()
         else:
             self.llm = None
         if flow_model is not None:
-            self.flow.load_state_dict(torch.load(flow_model, map_location=self.device))
+            self.flow.load_state_dict(torch.load(flow_model, map_location=self.device, weights_only=True))
             self.flow.to(self.device).eval()
         if hift_model is not None:
             if ".pt" not in hift_model:
@@ -340,4 +340,4 @@ def batch_inference(self, text, audio_token, audio_token_len, text_token, text_t
                                                 finalize=False)
                 music_audios.append({"music_audio":music_audio, "text":text[i]})
 
-        return music_audios
\ No newline at end of file
+        return music_audios

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.