Description

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover_if_possible(). Attackers can embed malicious Python object construction tags such as !!python/object/apply in any CKPT.yaml file within the configured checkpoint path to trigger code execution during candidate discovery, even if the malicious checkpoint is never selected for recovery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-27T20:17:02.130Z",
  "pubdate": "2026-08-27T20:17:02.130Z",
  "executiveSummary": "SpeechBrain versions prior to 1.1.1 are susceptible to an arbitrary code execution vulnerability stemming from insecure deserialization of YAML configuration files.\nThe vulnerability resides in the Checkpointer.recover_if_possible() method, which utilizes PyYAML's unsafe loader to parse CKPT.yaml metadata files located within the checkpoint directory.\nBy supplying a crafted CKPT.yaml file containing malicious Python object construction tags, an attacker can trigger the instantiation of arbitrary objects and execute unauthorized code during the candidate enumeration process.\nExploitation does not require the malicious checkpoint to be actively selected; mere presence of the crafted file in the designated path during the recovery discovery phase is sufficient to compromise the host environment.\nThis vulnerability poses a critical risk to systems processing untrusted model checkpoints, as it allows attackers to achieve remote code execution (RCE) with the privileges of the process executing the SpeechBrain framework.\nThe attack vector is local, assuming the attacker can place or influence the content of files within the checkpoint storage directory, making this particularly dangerous in multi-user environments or systems that ingest external model artifacts.",
  "technicalDetails": "The vulnerability is located in the Checkpointer component of SpeechBrain, specifically within the logic responsible for candidate enumeration during the execution of recover_if_possible().\nThe root cause is the usage of PyYAML's unsafe loading mechanism (yaml.load() or equivalent configuration without SafeLoader) when parsing CKPT.yaml metadata files. The PyYAML library's default behavior, when used unsafely, interprets custom YAML tags like !!python/object/apply, allowing for the instantiation of arbitrary Python objects and the execution of associated callable functions.\nThe attack flow proceeds as follows: An attacker with write access to the directory monitored by the Checkpointer creates or modifies a CKPT.yaml file. Within this file, the attacker injects a malicious payload utilizing Python tags to trigger system commands or arbitrary logic execution upon parsing.\nWhen the SpeechBrain application invokes Checkpointer.recover_if_possible(), the framework iterates through files in the checkpoint directory to identify viable candidates for recovery. During this enumeration, it parses the metadata files using the unsafe YAML loader.\nBecause the vulnerability occurs at the discovery phase, the malicious payload is executed immediately upon the metadata being read, regardless of whether the specific file is ultimately chosen for model recovery or state restoration.\nThis design flaw effectively bypasses intended security boundaries, as it grants code execution primitives during the initial phase of checkpoint inspection. The payload is executed under the security context of the user or service running the SpeechBrain process, potentially leading to full system compromise depending on the user's privilege level.\nThere are no specific authentication requirements for the application itself, as the vulnerability is triggered by the presence of a malicious configuration file on the local filesystem. Attackers leveraging this vulnerability can perform unauthorized operations, access sensitive data, or establish persistence within the host environment.\nVersions of SpeechBrain prior to 1.1.1 are considered vulnerable. The lack of input validation or the use of secure loading techniques (e.g., yaml.safe_load()) during the metadata parsing phase facilitates this remote code execution path."
}