Speaches
Monthly
Unauthenticated remote attackers can influence which classes or code paths are loaded by the speaches speech server (all builds up to and including 0.9.0-rc.3) by supplying a crafted 'model' argument to PyannoteDiarizationModelManager._load_fn in src/speaches/executors/pyannote_diarization.py. The CVSS 4.0 base score is 5.5 with impact limited to low confidentiality, integrity and availability (VC:L/VI:L/VA:L), and publicly available exploit code exists (a PoC archive is linked from the advisory) - there is no CISA KEV confirmation of active exploitation. Practical exposure is bounded by the need for the server to be network-reachable, the diarization feature to be enabled, and the deployment to run an affected pre-release build of this niche self-hosted tool.
Unauthenticated remote attackers can influence which classes or code paths are loaded by the speaches speech server (all builds up to and including 0.9.0-rc.3) by supplying a crafted 'model' argument to PyannoteDiarizationModelManager._load_fn in src/speaches/executors/pyannote_diarization.py. The CVSS 4.0 base score is 5.5 with impact limited to low confidentiality, integrity and availability (VC:L/VI:L/VA:L), and publicly available exploit code exists (a PoC archive is linked from the advisory) - there is no CISA KEV confirmation of active exploitation. Practical exposure is bounded by the need for the server to be network-reachable, the diarization feature to be enabled, and the deployment to run an affected pre-release build of this niche self-hosted tool.