SpeechBrain CVE-2026-10036

Exploitation requires that a file named CKPT.yaml containing PyYAML-compatible Python object construction tags (e.g., !!python/object/apply) be present anywhere within the directory tree configured as the SpeechBrain Checkpointer's checkpoint path. The attacker does not need to select or restore from the malicious checkpoint - code execution fires during the candidate enumeration phase of recover_if_possible() regardless of whether the checkpoint is ultimately chosen. The victim must invoke recover_if_possible() at least once with the compromised path present. The primary limiting factor is the file-delivery prerequisite: the attacker must have a mechanism to place the malicious CKPT.yaml in the checkpoint directory, most realistically through a supply-chain vector (distributing a tampered model package) or a shared-storage compromise. Deployments that load only internally generated checkpoints from access-controlled directories and never ingest third-party model archives are not directly exposed to this attack path.

The CVSS 4.0 score of 8.7 is grounded in high CIA impact and a low-complexity attack path, tempered by a passive user-interaction requirement (UI:P): a victim's system must invoke Checkpointer.recover_if_possible() against a path containing the malicious file. This is not a trivially internet-exposed surface - the attacker must first deliver the malicious CKPT.yaml into the checkpoint directory, most plausibly via a supply-chain vector such as a tampered model package on Hugging Face Hub or a similar repository. EPSS data was not provided in source intelligence, so statistical exploitation probability cannot be quoted. The CVE is not listed in the CISA KEV catalog, confirming that active exploitation is not currently verified. However, the underlying technique - PyYAML unsafe deserialization via !!python/object/apply - is one of the most thoroughly documented Python exploit classes, with tooling and write-ups available since at least 2017; the barrier to weaponizing this specific CVE is low once file-write capability to the checkpoint path is achieved. Risk is highest for automated ML training pipelines and research environments that pull third-party checkpoints without integrity verification; environments loading only internally-generated checkpoints from controlled storage face substantially lower realistic exposure.

An attacker publishes a trojanized SpeechBrain pretrained model on a public model hub, embedding a !!python/object/apply:subprocess.check_output YAML tag in the bundled CKPT.yaml that executes a reverse-shell payload. A researcher or automated MLOps pipeline downloads the archive and configures a SpeechBrain Checkpointer pointing to the extracted directory; on the next call to recover_if_possible(), the unsafe PyYAML loader parses CKPT.yaml during candidate enumeration and immediately executes the embedded command - before any checkpoint selection occurs, and with no further attacker interaction required. No CVE-specific proof-of-concept has been published, but the deserialization technique is identical to widely documented PyYAML exploitation patterns.