CVE-2026-10036

SpeechBrain before 1.1.1 parses CKPT.yaml checkpoint metadata using PyYAML's unsafe loader, deserializing attacker-controlled Python object tags (CWE-502, deserialization of untrusted data). During Checkpointer.recover_if_possible(), the library enumerates and parses every CKPT.yaml file in the configured checkpoint path, so a crafted file containing tags such as !!python/object/apply triggers arbitrary Python code execution during candidate discovery — even if that checkpoint is never selected for recovery. An attacker who can place or modify a checkpoint metadata file in a scanned directory (for example a third-party pretrained model bundle, a shared storage location, or any other attacker-influenced checkpoint path) gains arbitrary code execution in the context of the process running SpeechBrain. Any project running SpeechBrain before 1.1.1 with checkpoint recovery enabled is affected, with practical exposure concentrated in teams loading pretrained bundles or scanning checkpoint directories not fully under their control. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS currently assigns a 0.4% probability of exploitation within 30 days (30th percentile), indicating low near-term exploitation risk.

What to do: Upgrade SpeechBrain to 1.0.0 successor release 1.1.1 or later on all systems that use the Checkpointer recovery feature. Until upgraded, audit applications for uses of Checkpointer.recover_if_possible() and verify that checkpoint directories contain only trusted files, avoiding recovery scans on checkpoint paths populated by third-party model bundles, untrusted shared storage, or user-supplied uploads. As a compensating measure, restrict which directories are scanned for CKPT.yaml and treat checkpoint metadata files as untrusted input when sourced from outside your own training runs.