CVE-2026-112086— ESPnet Inference Model inference_model.py build_model deserialization
Quick assessment
Affected
n/a ESPnet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ESPnet（版本 202610.post2 及更早版本）中发现了一个漏洞。该漏洞影响组件"Inference Model Handler"中文件 的 函数。攻击者可通过操纵 参数触发反序列化操作，从而实现远程攻击。该漏洞的利用方式已公开，可被利用。修复该问题的补丁标识为 。建议尽快应用此补丁以解决该问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112086
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ESPnet Inference Model inference_model.py build_model deserialization
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | ESPnet | 202610.post2 |
cpe:2.3:a:espnet:espnet:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-112086
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112086
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-112086 (2)
Vendor Pages for CVE-2026-112086 (1)
Other References for CVE-2026-112086 (1)
Other References for CVE-2026-112086 (1)
Same Patch Batch · n/a · 2026-10-19 · 5 CVEs total
| CVE-2026-112098 | 6.3 MEDIUM | DeepPavlov Config Reference Resolver params.py resolve code injection |
| CVE-2026-112100 | 5.5 MEDIUM | DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection |
| CVE-2026-112045 | 5.4 MEDIUM | donetick History Deletion model.go CanDeleteHistory improper authorization |
| CVE-2026-38671 | Ellucian Banner 9.23 及以下版本跨站脚本漏洞 |
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-112100
DeepPavlov multitask_preprocessor.py MultiTaskPipelinePrepro -
CVE-2026-112098
DeepPavlov Config Reference Resolver params.py resolve code -
CVE-2026-112045
donetick History Deletion model.go CanDeleteHistory improper -
CVE-2026-38671
Ellucian Banner 9.23 及以下版本跨站脚本漏洞 -
CVE-2026-111874
OpenCATS Career Portal CareersUI.php processLogin excessive
Same weakness: CWE-502
-
CVE-2026-88900
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of -
CVE-2026-78165
Apache Camel: Camel-Spring-Redis Unfiltered Java Deserializa -
CVE-2026-78162
Apache Camel: Camel-Hazelcast Managed Instances Missing Java -
CVE-2026-111408
WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Obje -
CVE-2026-112081
hankcs HanLP Model Config Loading reflection.py hanlp.load d
V. Comments for CVE-2026-112086
No comments yet