Executive brief
SpeechBrain is an open-source speech processing toolkit used for training and running machine learning models on audio. The vulnerability allows attackers to execute arbitrary code when a user loads a checkpoint (saved model state) from an untrusted source—such as a downloaded model or archive—simply by parsing malicious checkpoint metadata files, even if the user never actually selects that checkpoint to restore.
Technical details
The vulnerability is a deserialization attack (CWE-502) in SpeechBrain's checkpoint recovery module. When Checkpointer.recover_if_possible() lists candidate checkpoints, it parses every CKPT.yaml metadata file using PyYAML's unsafe Loader (yaml.load() with Loader=yaml.Loader), which supports arbitrary Python object construction via tags like !!python/object/apply. An attacker can embed malicious YAML in a CKPT.yaml file placed in the checkpoint directory; the code executes during candidate enumeration before the user selects which checkpoint to restore. The attack requires the victim to call the checkpoint recovery function (typical in model loading workflows) but does not require user interaction beyond loading a checkpoint directory. The vulnerability affects SpeechBrain versions before 1.1.1 and is fixed in commit 22a6166 by switching to yaml.safe_load().
Affected products
- SpeechBrain SpeechBrain before 1.1.1
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fixed in version 1.1.1 via commit 22a6166 switching to yaml.safe_load()