EUVD-2026-67226
GHSA-f54r-jqhg-q7vg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector via checkpoint download; passive user invocation of recovery required (UI:R); no privileges needed on victim system; full code execution yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover_if_possible(). Attackers can embed malicious Python object construction tags such as !!python/object/apply in any CKPT.yaml file within the configured checkpoint path to trigger code execution during candidate discovery, even if the malicious checkpoint is never selected for recovery.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a file named CKPT.yaml containing PyYAML-compatible Python object construction tags (e.g., !!python/object/apply) be present anywhere within the directory tree configured as the SpeechBrain Checkpointer's checkpoint path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 is grounded in high CIA impact and a low-complexity attack path, tempered by a passive user-interaction requirement (UI:P): a victim's system must invoke Checkpointer.recover_if_possible() against a path containing the malicious file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a trojanized SpeechBrain pretrained model on a public model hub, embedding a !!python/object/apply:subprocess.check_output YAML tag in the bundled CKPT.yaml that executes a reverse-shell payload. A researcher or automated MLOps pipeline downloads the archive and configures a SpeechBrain Checkpointer pointing to the extracted directory; on the next call to recover_if_possible(), the unsafe PyYAML loader parses CKPT.yaml during candidate enumeration and immediately executes the embedded command - before any checkpoint selection occurs, and with no further attacker interaction required. … |
| Remediation | The definitive fix is upgrading SpeechBrain to version 1.1.1 or later, which introduces safe YAML loading for checkpoint metadata files via commit 22a616646a493871401461f80b2d5cf564cb2850 (PR #3067); release assets are available at https://github.com/speechbrain/speechbrain/releases/tag/v1.1.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running SpeechBrain and document the current deployed version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today