VoxCPM is a text-to-speech model from OpenBMB, the group behind the MiniCPM models. The current release, VoxCPM2, is a 2-billion-parameter model trained on more than 2 million hours of speech. It reads text in 30 languages, including English, Chinese, Japanese, Korean, Hindi, Arabic and most of Western Europe, plus several Chinese dialects, and outputs 48 kHz audio. You install it with pip and call it from Python, a command line tool or a small web demo.
Its headline features are voice design and voice cloning. Voice design creates a new voice from a written description, such as a young woman with a gentle voice, with no audio needed. Voice cloning copies a real person's voice from a short recording, and its strongest mode takes the recording plus a transcript and continues in that voice with the same timbre, rhythm and emotion. That makes it useful for narration, dubbing and accessibility, and it also means it can imitate someone who never agreed to it. The project's own Risks section forbids impersonation, fraud and disinformation and asks users to label AI-generated audio; only clone voices you have permission to use.
Code and weights are Apache-2.0, so commercial use is allowed. It needs an NVIDIA GPU with about 8 GB of memory for comfortable speed, though the web demo can also run on Apple Silicon or CPU, and community ports run it through llama.cpp and ONNX. The authors note that voice design and controlled cloning can vary between runs, so expect to generate a line two or three times.
- Repository: github.com/OpenBMB/VoxCPM
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 40.6K. Forks: 4,621. Last push: Oct 8, 2026.
- Scan: safe, Oct 26, 2026, commit cce58a5
Who it is for
Developers and creators who want a local, commercially usable text-to-speech model in many languages, for narration, game and video voices, or reading apps, and who have a GPU to run it on.
Getting started
1. Install the package (Python 3.10 to 3.12, PyTorch 2.5 or later)
pip install voxcpm2. Generate speech with a voice described in words
voxcpm design --text "VoxCPM2 brings studio-quality multilingual speech synthesis." --output out.wav3. Clone a voice from a recording you have permission to use
voxcpm clone --text "This is a voice cloning demo." --reference-audio path/to/voice.wav --output out.wavThe first run downloads the model weights from Hugging Face. For a browser interface, clone the repository and run python app.py --port 8808, then open http://localhost:8808.
Safety scan
We cloned OpenBMB/VoxCPM at commit cce58a5 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no installers or install hooks, no committed binaries and no bare-IP URLs across 82 files, about 13,000 lines of them Python. The only hosts in the code are github.com and apache.org.
- Voice cloning is a headline feature: a few seconds of someone's speech is enough to make the model talk in their voice. The README's Risks section forbids impersonation and fraud and recommends marking AI audio, but nothing in the code checks consent, so that responsibility is yours.
- uv.lock pins 192 packages with 159 known advisories (8 critical, 72 high). Most are in Pillow (image decoding), aiohttp, Gradio and similar libraries pinned for development; pip install voxcpm resolves newer versions within its own ranges, so keep your environment updated rather than installing from the lockfile.
- Model weights are downloaded from Hugging Face or ModelScope at first use, and the model loads them with PyTorch. Getting them from the official openbmb pages is the safe path.
- One workflow, with one third-party action pinned to a tag rather than a commit, none using pull_request_target. Licence present; no security policy, contributing guide or Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 1 workflow. None use pull_request_target. 1 of 1 third-party action pinned to a tag rather than a commit. |
| Network hosts | 2 distinct hosts referenced from source; most often github.com, www.apache.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 159 advisories across 192 pinned packages: 8 critical, 72 high, 53 moderate, 26 low. uv.lock: 192 packages, 159 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Worst known vulnerabilities (24 of 159)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-82r6-8w77-94w6 | critical | anyio@4.12.1 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-9v8h-qqgm-4m35 | critical | brotli@1.2.0 | Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package |
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2026.2.25 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-332p-7hrc-92wf | critical | pillow@11.3.0 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO |
| GHSA-5x8w-8jj5-q52h | critical | pillow@11.3.0 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution |
| GHSA-8g5g-8vmr-9782 | critical | pillow@11.3.0 | Pillow: Heap buffer overflow in ImagingJpegDecode |
| GHSA-v9pv-5gc8-w2m6 | critical | pillow@11.3.0 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| GHSA-w889-685w-c8fh | critical | pillow@11.3.0 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE |
| GHSA-2g87-pp6c-29x5 | high | aiohttp@3.13.3 | aiohttp: Multiple instances of excessive or unbounded memory/CPU use |
| GHSA-5wr8-gcqf-gqf3 | high | aiohttp@3.13.3 | aiohttp server lacks an initial request/header timeout |
| GHSA-9xw5-w5jj-pvcg | high | aiohttp@3.13.3 | AIOHTTP: File descriptor exhaustion in multipart requests |
| GHSA-cq5v-8q36-5273 | high | aiohttp@3.13.3 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| GHSA-cg8m-r9f2-5wm2 | high | black@26.3.1 | Black: GitHub Action installs unvalidated required-version from pyproject.toml |
| GHSA-537c-gmf6-5ccf | high | cryptography@46.0.5 | Vulnerable OpenSSL included in cryptography wheels |
| GHSA-g6cj-pr64-35w5 | high | cryptography@46.0.5 | cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing |
| GHSA-jwv3-5hgf-82ww | high | cryptography@46.0.5 | python-cryptography: Duplicate self-signed intermediates can cause exponential path-building |
| GHSA-v4x8-3wr5-3wq8 | high | filelock@3.25.2 | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock us… |
| GHSA-27vj-qcqg-25rc | high | fsspec@2025.3.0 | fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution |
| GHSA-7hp7-4p35-3cx2 | high | gradio@6.9.0 | Gradio contains a cookie injection vulnerability |
| GHSA-j36p-7w88-g82j | high | gradio@6.9.0 | Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks |
| GHSA-2cp2-2r3c-7p7r | high | hydra-core@1.3.2 | Hydra: hydra.utils.instantiate with untrusted config can lead to code execution |
| GHSA-c3wx-c55w-pxjq | high | hydra-core@1.3.2 | Hydra logging configuration permits unsafe callable resolution |
| GHSA-6v7p-g79w-8964 | high | msgpack@1.1.2 | MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error |
| GHSA-22hg-r758-rrw9 | high | pillow@11.3.0 | Pillow: Infinite loop in MIC n_frames when the embedded TIFF |
By the numbers
| Stars | 40.6K |
|---|---|
| Forks | 4,621 |
| Contributors | 31 |
| Commits | 182 |
| Open issues | 106 |
| Open pull requests | 63 |
| Releases | 14 |
| Latest release | 2.0.3 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 1 year |
| Last push | Oct 8, 2026 |
| Tracked files | 82 |
| Lines of code | 14.9K |
| Checkout size | 6 MB |
Lines by language: Python 12.9K, Markdown 1,544, YAML 286, TOML 101.
Questions
Is VoxCPM free?
Yes. The code and the model weights are released under Apache-2.0, which allows commercial use. You need your own hardware, ideally an NVIDIA GPU, to run it.
Can VoxCPM clone a real person's voice?
Yes, and it is one of its main features. Give it a short recording, optionally with a transcript, and it speaks new text in that voice. The project forbids using this for impersonation, fraud or disinformation and asks you to label AI-generated audio. Only clone your own voice or one you have clear permission to use; impersonating someone can be illegal.
What hardware does VoxCPM need?
The project lists about 8 GB of GPU memory for VoxCPM2 and CUDA 12 or later for the standard install, with real-time-factor figures measured on an RTX 4090. The web demo can also run on Apple Silicon or CPU, more slowly, and community ports run it through llama.cpp and ONNX.
Which languages does it speak?
Thirty, including English, Chinese, Japanese, Korean, Hindi, Arabic, Russian, Spanish, French, German, Portuguese, Thai and Vietnamese, plus several Chinese dialects such as Cantonese and Sichuanese. You do not need to tag the language; it is detected from the text.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.