CVE-2025-27780

CVE-2025-27780 is a critical unsafe deserialization vulnerability affecting Applio versions 3.2.8-bugfix and prior, a voice conversion tool. An attacker can achieve remote code execution by providing malicious input to the model_name parameter, which is then loaded via torch.load. This vulnerability carries a CVSS score of 9.8 (CRITICAL) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.