CVE-2025-27779: Critical Unsafe Deserialization in Applio Model Blender

CVE-2025-27779 is a critical (CVSS 9.8) unsafe deserialization flaw in the model blender of Applio 3.2.8-bugfix and earlier. User-supplied model paths reach torch.load, which can lead to remote code execution. A patch is on the main branch, so update from there and limit network access.

What's affected

The record says Applio versions 3.2.8-bugfix and prior are affected. Applio is described as a voice conversion tool. The record describes model_fusion_a and model_fusion_b in the voice blender tab. They take a user-supplied path to a model and pass it to run_model_blender_script, and later to the model_blender function, which loads both models with torch.load on lines 20 and 21 of model_blender.py in 3.2.8-bugfix.

The record says a patch is available on the main branch of the Applio repository.

This CVE is one of thirteen reported together by GitHub Security Lab in CVE-2025-27774 to CVE-2025-27786, covering unsafe deserialization, server-side request forgery, arbitrary file write, arbitrary file read and arbitrary file removal in the same project.

Severity in the record: critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness classes: CWE-502 (Deserialization of untrusted data).

How to check if you're exposed

Applio is a Python application, so check how you installed it.

git -C /path/to/Applio log -1 --format=%H
git -C /path/to/Applio describe --tags
pip list 2>/dev/null | grep -i applio

The record says versions 3.2.8-bugfix and prior are affected. If you track the main branch, compare your commit with the fix commits linked in Sources.

Then check exposure. Applio runs a web interface with tabs for inference, text to speech, training and model tools. Find out whether it listens on anything other than localhost and whether it sits behind a reverse proxy, a tunnel or a public share link.

For the Python packages your own projects pull in, the free in-browser scan at gold.safeguard.sh/scan reads requirements.txt.

What to do now

1. Stop exposing the Applio interface to untrusted networks. Bind it to localhost or a private network and put authentication in front of it.
2. Update to a build that includes the patch commit linked in Sources, then restart the service.
3. Do not load model files, checkpoints or paths that you did not create or verify yourself.
4. Run Applio as a low privilege user, ideally in a container or virtual machine with no access to your other files or credentials.
5. If you use the voice blender, only point it at model files you trained or downloaded from a source you trust and checked.
6. Subscribe to the repository's releases and the advisory so you hear when a numbered release carries the fix.

Why it matters

Unsafe deserialization (CWE-502) means a program rebuilds an object from data that someone else controls, and the rebuilding step can run code. Python's torch.load uses pickle by default, which can execute code while reading a file. If an attacker can make the application load a file they supplied or chose, that file can act as a program. The record says this can lead to remote code execution.

The 9.8 score reflects a network attack that needs no login and no user interaction. For an AI tool, model files are a normal thing to download and share, so the habit of loading a file without thinking is common. The safe pattern is to load only weights, use a safe loading mode, and verify where files came from.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Quick check

Sources

• GitHub Security Lab advisory GHSL-2024-341 to GHSL-2024-353
• https://github.com/IAHispano/Applio/commit/11d139508d615a6db4d48b76634a443c66170dda
• Safeguard Gold entry for CVE-2025-27779

Last reviewed: 19 October 2026.