{"id":"CVE-2026-112086","kind":"vulnerability","aliases":["CVE-2026-112086"],"related":[],"title":"ESPnet: model inference handler deserializes attacker-controlled _target_ argument","description":"A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.","summary":"ESPnet up to 202610.post2 has a flaw in build_model in espnet3/publication/inference_model.py where the _target_ argument is deserialized without checks. A remote attacker who can supply that argument can get code run on the machine that loads the model.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["espnet","ml-inference","package","python"],"not_affected_if":["trusted-config-only"],"how_to_check":"- Check the installed ESPnet version, for example with `pip show espnet`, and compare it to `202610.post2`\n- Look for `espnet3/publication/inference_model.py` in the installed package and check whether `build_model` accepts a `_target_` value from outside input","fix":"- Move ESPnet past `202610.post2` to a release that includes commit `f217b24f06de55e332cab10231469d5890dbbe00`\n- Until upgraded, do not pass untrusted configuration into the inference model handler","status":"open","published_at":"2026-10-19T06:17:23+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:18+00:00","updated_at":"2026-10-25T03:23:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:23:18Z","model":"claude-haiku-5-5","output":{"fix":"- Move ESPnet past `202610.post2` to a release that includes commit `f217b24f06de55e332cab10231469d5890dbbe00`\n- Until upgraded, do not pass untrusted configuration into the inference model handler","reach":"internet","title":"ESPnet: model inference handler deserializes attacker-controlled _target_ argument","impact":"high","summary":"ESPnet up to 202610.post2 has a flaw in build_model in espnet3/publication/inference_model.py where the _target_ argument is deserialized without checks. A remote attacker who can supply that argument can get code run on the machine that loads the model.","category":"package","nicknames":[],"who_cares":["espnet","python","ml-inference"],"confidence":0.6,"needs_auth":"unknown","worst_case":"code runs on the server that loads the model","analyst_note":"Confirm from the NVD entry or the linked patch commit which entry points accept untrusted _target_ values and whether a fixed release tag exists.","how_to_check":"- Check the installed ESPnet version, for example with `pip show espnet`, and compare it to `202610.post2`\n- Look for `espnet3/publication/inference_model.py` in the installed package and check whether `build_model` accepts a `_target_` value from outside input","needs_analyst":true,"not_affected_if":["trusted-config-only"],"who_is_affected":"Teams that run ESPnet 3 inference through the publication inference model handler and pass it configuration or model specifications that come from users or other untrusted sources. Projects that only load their own fixed model configs in a trusted pipeline are much less exposed. unknown whether the sources name a specific deployment pattern beyond this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000643,"input_tokens":3358,"output_tokens":614,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112086':13A,16A '-2026':12A,15A '202610':26B,71C 'affect':74C 'appli':127C 'argument':10A,39B,51B,93C 'attack':7A,46B,104C 'attacker-control':6A 'best':124C 'build':32B,77C 'check':43B 'code':54B 'compon':85C 'control':8A 'could':113C 'cve':11A,14A 'deseri':5A,41B,97C 'espnet':1A,17B,23B,68C 'espnet3/publication/inference_model.py':35B,82C 'exploit':107C 'f217b24f06de55e332cab10231469d5890dbbe00':121C 'file':81C 'flaw':30B 'found':66C 'function':76C 'get':53B 'handler':4A,88C 'identifi':119C 'infer':3A,20B,86C 'issu':133C 'launch':102C 'load':60B 'machin':58B 'made':110C 'manipul':90C 'ml':19B 'ml-infer':18B 'model':2A,33B,62B,78C,87C 'packag':21B 'patch':117C,129C 'possibl':100C 'post2':27B,72C 'practic':125C 'public':111C 'python':22B 'remot':45B,105C 'resolv':131C 'result':95C 'run':55B 'suppli':49B 'target':9A,38B,94C 'use':115C 'vulner':64C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Teams that run ESPnet 3 inference through the publication inference model handler and pass it configuration or model specifications that come from users or other untrusted sources. Projects that only load their own fixed model configs in a trusted pipeline are much less exposed. unknown whether the sources name a specific deployment pattern beyond this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112086","severity":null,"published_at":"2026-10-19T06:17:23+00:00","modified_at":"2026-10-19T18:17:02+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}