Arbitrary Code Execution in speaches-ai speaches

The speaches-ai speaches library, specifically versions up to and including 0.9.0-rc.3, contains a critical vulnerability in the PyannoteDiarizationModelManager._load_fn function within src/speaches/executors/pyannote_diarization.py. The issue arises from the insecure handling of the 'model' argument, which allows an attacker to supply externally-controlled input that is used to select classes or code for execution. This vulnerability, introduced in PR #628 (commit 870e1e16a73452496e99d49f759eabd692a8e0e0), enables remote code execution. As the exploit is publicly disclosed and the maintainers have not yet provided a patch, users of the library are currently at risk of exploitation if their application exposes this diarization model loading functionality to unauthenticated or untrusted input.

Impact

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code with the privileges of the application process. This can lead to full system compromise, data exfiltration, or lateral movement within the environment where the speaches-ai library is deployed. The vulnerability impacts any application leveraging the affected pyannote_diarization executor.

Recommendation

1. Review all applications using speaches-ai speaches versions <= 0.9.0-rc.3 and identify instances where user-supplied input flows into the 'model' argument of PyannoteDiarizationModelManager._load_fn.
2. Implement strict input validation or sandboxing for the 'model' parameter to prevent the loading of unauthorized or arbitrary classes.
3. Monitor vendor repositories for a patched release and update speaches-ai speaches immediately once available.
4. If updating is not currently possible, restrict access to the affected endpoint or functionality to trusted internal sources only.