FunAudioLLM InspireMusic deserialization vulnerability
A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function load_state_dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. An attack has to be approached locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 784cbf8dde2cf1456ff808aeba23177e1810e7a9. It is recommended to apply a patch to fix this issue.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | inspiremusic | <= 0.0.1.dev0 | no fix |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-5148
- https://github.com/FunAudioLLM/InspireMusic/issues/53
- https://github.com/FunAudioLLM/InspireMusic/issues/53#issuecomment-2866688220
- https://github.com/FunAudioLLM/InspireMusic/commit/784cbf8dde2cf1456ff808aeba23177e1810e7a9
- https://github.com/FunAudioLLM/InspireMusic
- https://vuldb.com/?ctiid.310236
- https://vuldb.com/?id.310236
- https://vuldb.com/?submit.573800
- https://pypi.org/project/inspiremusic
- https://github.com/advisories/GHSA-pgp9-g5q8-j3wp
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-20, CWE-502- Platform
- Python (PyPI)
- Package
inspiremusic- Disclosed
- 25.05.2025
- Updated
- 11.10.2026 13:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1464 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-pgp9-g5q8-j3wp - CC BY 4.0
Vulnerability history: inspiremusic
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.