CVE-2026-10036

Arbitrary code execution via crafted CKPT.yaml loaded with PyYAML unsafe loader.

• CVSS 8.7
• 502
• Input Validation and Sanitization
• Local

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover_if_possible(). Attackers can embed malicious Python object construction tags such as !!python/object/apply in any CKPT.yaml file within the configured checkpoint path to trigger code execution during candidate discovery, even if the malicious checkpoint is never selected for recovery.

CVE

CVE-2026-10036

CWE

502

CVSS base score

8.7

Published

2026-08-27

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

SpeechBrain

Fixed by upgrading

Yes

Solution

Upgrade SpeechBrain to version 1.1.1 or newer, which replaces the unsafe PyYAML loader with a safe loader to fix the arbitrary code execution issue.

import os
import yaml

class Checkpointer:
    def __init__(self, ckpt_dir):
        self.ckpt_dir = ckpt_dir

    def recover_if_possible(self):
        # VULNERABLE: uses unsafe yaml.load allowing arbitrary object construction
        for entry in os.listdir(self.ckpt_dir):
            if entry.endswith('.yaml'):
                path = os.path.join(self.ckpt_dir, entry)
                with open(path, 'r') as f:
                    meta = yaml.load(f, Loader=yaml.FullLoader)  # unsafe
                if meta.get('recoverable'):
                    return meta
        return None

import os
import yaml

class Checkpointer:
    def __init__(self, ckpt_dir):
        self.ckpt_dir = ckpt_dir

    def recover_if_possible(self):
        # FIX: use safe_load to prevent arbitrary code execution
        for entry in os.listdir(self.ckpt_dir):
            if entry.endswith('.yaml'):
                path = os.path.join(self.ckpt_dir, entry)
                with open(path, 'r') as f:
                    meta = yaml.safe_load(f)  # safe
                if meta and meta.get('recoverable'):
                    return meta
        return None

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202610036,
  title        = {{Arbitrary code execution via crafted CKPT.yaml loaded with PyYAML unsafe loader.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-10036},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-10036/}}
}