CVE-2025-5148: FunAudioLLM InspireMusic deserialization vulnerability
(updated )
A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function load_state_dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. An attack has to be approached locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 784cbf8dde2cf1456ff808aeba23177e1810e7a9. It is recommended to apply a patch to fix this issue.
References
- github.com/FunAudioLLM/InspireMusic
- github.com/FunAudioLLM/InspireMusic/commit/784cbf8dde2cf1456ff808aeba23177e1810e7a9
- github.com/FunAudioLLM/InspireMusic/issues/53
- github.com/FunAudioLLM/InspireMusic/issues/53
- github.com/advisories/GHSA-pgp9-g5q8-j3wp
- nvd.nist.gov/vuln/detail/CVE-2025-5148
- vuldb.com/?ctiid.310236
- vuldb.com/?id.310236
- vuldb.com/?submit.573800
Code Behaviors & Features
Detect and mitigate CVE-2025-5148 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →