{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/speechbrain/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-10036"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SpeechBrain"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SpeechBrain"],"content_html":"\u003cp\u003eSpeechBrain versions prior to 1.1.1 contain an arbitrary code execution vulnerability (CVE-2026-10036) stemming from the use of PyYAML's unsafe loader within the \u003ccode\u003eCheckpointer.recover_if_possible()\u003c/code\u003e method. When the library attempts to discover checkpoints, it iterates over available files and parses \u003ccode\u003eCKPT.yaml\u003c/code\u003e metadata. By placing a crafted YAML file containing malicious Python object construction tags, such as \u003ccode\u003e!!python/object/apply\u003c/code\u003e, into a directory monitored by the checkpointer, an attacker can force the application to instantiate arbitrary objects and execute code. The vulnerability is triggered during the candidate enumeration process, meaning the malicious payload is executed even if the checkpoint is not ultimately selected for recovery. This impact is significant for applications using SpeechBrain to process untrusted model checkpoints or operating in shared environments where checkpoint directories are accessible to attackers.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application utilizing SpeechBrain for model checkpoint management.\u003c/li\u003e\n\u003cli\u003eAttacker gains write access to a directory that is scanned by the application's \u003ccode\u003eCheckpointer\u003c/code\u003e instance.\u003c/li\u003e\n\u003cli\u003eAttacker places a malicious file named \u003ccode\u003eCKPT.yaml\u003c/code\u003e into the target directory.\u003c/li\u003e\n\u003cli\u003eThe malicious YAML includes payload tags such as \u003ccode\u003e!!python/object/apply:os.system ['command_here']\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application calls \u003ccode\u003eCheckpointer.recover_if_possible()\u003c/code\u003e as part of its initialization or model loading lifecycle.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eCheckpointer\u003c/code\u003e enumerates files in the directory and invokes \u003ccode\u003eyaml.load()\u003c/code\u003e (unsafe loader) on the attacker-controlled \u003ccode\u003eCKPT.yaml\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe PyYAML parser interprets the embedded Python tags, resulting in the execution of the attacker's command with the privileges of the application process.\u003c/li\u003e\n\u003cli\u003eFinal objective achieved: remote command execution within the application environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full arbitrary code execution within the context of the Python process running the SpeechBrain framework. This can lead to unauthorized data exfiltration, system compromise, and the installation of persistent malicious implants on the host server. The vulnerability carries a CVSS v3.1 base score of 8.8, indicating high potential for exploitation in environments where checkpoint locations are not strictly protected or are populated by external sources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade SpeechBrain to version 1.1.1 or higher immediately to resolve CVE-2026-10036.\u003c/li\u003e\n\u003cli\u003eAudit all file paths used by the \u003ccode\u003eCheckpointer\u003c/code\u003e to ensure they are read-only for all users except the authorized service account.\u003c/li\u003e\n\u003cli\u003eImplement strict access control lists on directories where model checkpoints are stored to prevent unauthorized file placement.\u003c/li\u003e\n\u003cli\u003ePerform static analysis on codebases utilizing SpeechBrain to identify instances of PyYAML usage with the default \u003ccode\u003eload()\u003c/code\u003e function and enforce the use of \u003ccode\u003esafe_load()\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-27T21:10:08Z","date_published":"2026-08-27T21:10:08Z","id":"https://feed.craftedsignal.io/briefs/2026-08-speechbrain-rce/","summary":"SpeechBrain versions prior to 1.1.1 are vulnerable to arbitrary code execution when the Checkpointer component parses maliciously crafted CKPT.yaml files using PyYAML's unsafe loader.","title":"Arbitrary Code Execution in SpeechBrain via Insecure YAML Deserialization","url":"https://feed.craftedsignal.io/briefs/2026-08-speechbrain-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - SpeechBrain","version":"https://jsonfeed.org/version/1.1"}