CVE-2025-27778: Critical Unsafe Deserialization in Applio infer.py

CVE-2025-27778 is a critical (CVSS 9.8) unsafe deserialization flaw in infer.py in Applio 3.2.8-bugfix and earlier. The record says it can lead to remote code execution. The fix is on the main branch but not in a numbered release, so update from main and keep the interface off public networks.

What's affected

The record says Applio versions 3.2.8-bugfix and prior are affected. Applio is described as a voice conversion tool. The flaw is in infer.py, the inference path that loads a voice model.

As of publication the fix is available on the main branch of the Applio repository, but it is not attached to a numbered release, according to the record.

This CVE is one of thirteen reported together by GitHub Security Lab in CVE-2025-27774 to CVE-2025-27786, covering unsafe deserialization, server-side request forgery, arbitrary file write, arbitrary file read and arbitrary file removal in the same project.

Severity in the record: critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness classes: CWE-502 (Deserialization of untrusted data).

How to check if you're exposed

Applio is a Python application, so check how you installed it.

git -C /path/to/Applio log -1 --format=%H
git -C /path/to/Applio describe --tags
pip list 2>/dev/null | grep -i applio

The record says versions 3.2.8-bugfix and prior are affected. If you track the main branch, compare your commit with the fix commits linked in Sources.

Then check exposure. Applio runs a web interface with tabs for inference, text to speech, training and model tools. Find out whether it listens on anything other than localhost and whether it sits behind a reverse proxy, a tunnel or a public share link.

For the Python packages your own projects pull in, the free in-browser scan at gold.safeguard.sh/scan reads requirements.txt.

What to do now

1. Stop exposing the Applio interface to untrusted networks. Bind it to localhost or a private network and put authentication in front of it.
2. Move to a build that includes the fix commit linked in Sources, by pulling the current main branch or checking for a newer release. Restart the service afterwards.
3. Do not load model files, checkpoints or paths that you did not create or verify yourself.
4. Run Applio as a low privilege user, ideally in a container or virtual machine with no access to your other files or credentials.
5. Check the model and cache folders for files you do not recognise and remove them after you have confirmed they are not yours.
6. Subscribe to the repository's releases and the advisory so you hear when a numbered release carries the fix.

Why it matters

Unsafe deserialization (CWE-502) means a program rebuilds an object from data that someone else controls, and the rebuilding step can run code. Python's torch.load uses pickle by default, which can execute code while reading a file. If an attacker can make the application load a file they supplied or chose, that file can act as a program. The record says this can lead to remote code execution.

The 9.8 score reflects a network attack that needs no login and no user interaction. For an AI tool, model files are a normal thing to download and share, so the habit of loading a file without thinking is common. The safe pattern is to load only weights, use a safe loading mode, and verify where files came from.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Try it yourself

This demo walks through how to tell a vulnerability that can be reached in your environment from one that cannot, which is the question to ask about a tool like Applio.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub Security Lab advisory GHSL-2024-341 to GHSL-2024-353
• https://github.com/IAHispano/Applio/commit/16019befdcbbff0b264a5e30785feef4b70df8d9
• https://github.com/IAHispano/Applio/commit/eb21d9dd349a6ae1a28c440b30d306eafba65097
• Safeguard Gold entry for CVE-2025-27778

Last reviewed: 19 October 2026.