Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls the result as args_class(*args, **kwargs) where kwargs is the config's own init_args mapping. No allowlist constrains the dotted path, so a configuration may name any importable callable and supply the arguments it is called with. Vocos.from_hparams reaches this for each of the feature_extractor, backbone and head entries, and Vocos.from_pretrained reaches it with a remote file: it downloads config.yaml from a caller-named Hugging Face repository and passes it straight to from_hparams. Loading a model from a repository the user does not control therefore executes code of the repository owner's choosing in the loading process. The neighbouring torch.load of the downloaded weights is a separate matter and is constrained on PyTorch releases that default weights_only to true, which leaves this path as the reachable one.

CVE-2026-79784 describes a critical arbitrary code execution vulnerability in the Vocos Python library, a neural vocoder used in AI/ML workflows. The vulnerability exists in the instantiate_class function within vocos/pretrained.py, which loads a class path from a configuration file without any allowlist or restriction on which class may be named. The function uses Python's __import__ and getattr to dynamically import and instantiate any callable, passing user-controlled arguments. The Vocos.from_pretrained method downloads a remote config.yaml from a Hugging Face repository specified by the caller and passes it directly to from_hparams, meaning loading a model from an untrusted repository results in execution of arbitrary code chosen by the repository owner. This is distinct from the torch.load deserialization risk, which is mitigated in newer PyTorch versions. The attack surface is significant for any user or pipeline that loads Vocos models from third-party or community Hugging Face repositories. No allowlist or sandboxing constrains the class path resolution, making this a straightforward remote code execution vector during model loading.