---
id: "CVE-2026-112086"
kind: "vulnerability"
aliases: ["CVE-2026-112086"]
title: "ESPnet: model inference handler deserializes attacker-controlled _target_ argument"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["espnet", "ml-inference", "package", "python"]
not_affected_if: ["trusted-config-only"]
published_at: "2026-10-19T06:17:23+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:23:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112086", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# ESPnet: model inference handler deserializes attacker-controlled _target_ argument

ESPnet up to 202610.post2 has a flaw in build_model in espnet3/publication/inference_model.py where the _target_ argument is deserialized without checks. A remote attacker who can supply that argument can get code run on the machine that loads the model.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ESPnet version, for example with `pip show espnet`, and compare it to `202610.post2`
- Look for `espnet3/publication/inference_model.py` in the installed package and check whether `build_model` accepts a `_target_` value from outside input

## Fix

- Move ESPnet past `202610.post2` to a release that includes commit `f217b24f06de55e332cab10231469d5890dbbe00`
- Until upgraded, do not pass untrusted configuration into the inference model handler

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112086

## From the sources

A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_