CVE-2026-10036
SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover_if_possible(). Attackers can embed malicious Python object construction tags such as !!python/object/apply in any CKPT.yaml file within the configured checkpoint path to trigger code execution during candidate discovery, even if the malicious checkpoint is never selected for recovery.
| CWE | CWE-502 |
| Vendor | speechbrain |
| Product | speechbrain |
| Published | Aug 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for speechbrain speechbrain
Be the first to know when new high vulnerabilities affecting speechbrain speechbrain are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
speechbrain / speechbrain
0 < 1.1.1
References
github.com: https://github.com/speechbrain/speechbrain/releases/tag/v1.1.1 github.com: https://github.com/speechbrain/speechbrain/pull/3067 github.com: https://github.com/speechbrain/speechbrain/commit/22a616646a493871401461f80b2d5cf564cb2850 vulncheck.com: https://www.vulncheck.com/advisories/speechbrain-arbitrary-code-execution-via-ckpt-yaml-parsing
Credits
Sai Teja Erukude VulnCheck