The fine-tuning resume path in scripts/train_voxcpm_finetune.py called
torch.load() without weights_only=True for the LoRA checkpoint, full-model
checkpoint, optimizer, and scheduler. Loading an attacker-supplied checkpoint
directory would therefore execute arbitrary code during unpickling.
Every inference-time loader (model/voxcpm.py, model/voxcpm2.py, LoRA loading)
already passes weights_only=True, and the project ships a test asserting LoRA
loading rejects malicious pickle payloads. This closes the remaining gap so the
resume path matches that posture.
Also:
- app.py: add a --host flag so the Gradio server can bind to 127.0.0.1 instead
of being hardwired to 0.0.0.0 (default unchanged to preserve current behavior).
The UI exposes an unauthenticated api_name="generate" endpoint.
- tests/test_torch_load_safety.py: AST guard asserting every torch.load across
src/, scripts/, app.py and lora_ft_webui.py sets weights_only=True, plus a
behavioral check that a malicious pickle is blocked.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Added regex to strip parentheses from control instructions in the text synthesis method to ensure compatibility with the expected prompt format. This change improves the robustness of the input handling.
