CVE-2026-10036: SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible(). Attackers can embed malicious Python object construction tags such as !!python/object/apply in any CKPT.yaml file within the configured checkpoint path to trigger code execution during candidate discovery, even if the malicious checkpoint is never selected for recovery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SpeechBrainto a version that resolves this vulnerability.Fixed in 1.1.1 - Compensating control
Ensure the checkpoint path configured for SpeechBrain does not include attacker-writable directories, so malicious CKPT.yaml files with tags like !!python/object/apply cannot be introduced.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using SpeechBrain versions before 1.1.1 are exposed if they call Checkpointer.recover_if_possible() with a checkpoint path where an attacker can place or modify a CKPT.yaml file. The attacker does not need to control the checkpoint ultimately selected for recovery.
What does an attacker need to exploit it?
An attacker needs to supply a crafted CKPT.yaml file in the configured checkpoint path. Exploitation is triggered when candidate checkpoints are enumerated, and requires no authentication or other privileges according to the CVSS vector.
Does the malicious checkpoint need to be restored?
No. Code execution can occur while SpeechBrain discovers candidate checkpoints because it parses CKPT.yaml during enumeration, even when the malicious checkpoint is not selected for recovery.
What can be done if upgrading is not immediately possible?
Do not run recovery against checkpoint directories containing untrusted files. Restrict write access to configured checkpoint paths and remove or quarantine unexpected CKPT.yaml files before invoking Checkpointer.recover_if_possible().
How can I determine whether a deployment is affected?
Check whether the deployed SpeechBrain version is earlier than 1.1.1 and whether the application invokes Checkpointer.recover_if_possible(). Also review configured checkpoint directories for CKPT.yaml files that may have been supplied or modified by untrusted parties.