19 matches found
CVE-2026-10036-speechbrain-rce
CVE-2026-10036: SpeechBrain Arbitrary Code Execution via CKPT.yaml Parsing Severity: High, CVSS 4.0 8.7 , CVSS 3.1 8.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected:...
SpeechBrain 1.1.0 Checkpoint Metadata Code Execution
SpeechBrain versions before 1.1.1 contain an unsafe PyYAML loader in checkpoint metadata parsing, allowing attacker-controlled CKPT.yaml content to execute code during checkpoint candidate enumeration. A proof of concept is included. https://packetstorm.news/download/235223...
hearbaseline (>=2021.0.3, <=2021.0.5), pydebiaseddta (0.1.0) +2 more potentially affected by CVE-2026-9856 via transformers (4.4.0)
transformers PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - hearbaseline =2021.0.3, =1.0.0a0, =0.6.20, =0.7.18 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...
Exploit for CVE-2026-10036
CVE-2026-10036: SpeechBrain Arbitrary Code Execution via CKPT...
CVE-2026-10036
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...
CVE-2026-10036 SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...
academia-tts (>=0.2.3, <=0.2.4), b2aiprep (>=0.20.0, <=4.0.0) +30 more potentially affected by CVE-2026-10036 via speechbrain (>=0.5.11, <=1.0.3)
speechbrain PYPI version =0.5.11, =0.2.3, =0.20.0, =0.1.0, =0.35.1, =2.1.0, =0.6.0, =0.3.1, =1.0.0, =0.0.28, =0.0.1, =1.0.0.post1, =0.0.2, =1.1.1, =1.1.2 - ovos-audio-transformer-plugin-speechbrain-langdetect 0.0.0a10 and more Source cves: CVE-2026-10036 Source advisory: MEND:CVE-2026-10036...
CVE-2026-10036 SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...
CVE-2026-10036
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...
CVE-2026-10036 SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...
EUVD-2026-67226
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...
CVE-2026-10036
SpeechBrain versions before 1.1.1 contain an arbitrary code execution vulnerability in its checkpoint recovery mechanism. The root cause is the use of PyYAML's unsafe loader when parsing CKPT.yaml metadata files during candidate enumeration in Checkpointer.recover_if_possible(). An attacker who c...
CVE-2026-10036: Deserialization of Untrusted Data
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...
PT-2026-82650
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover if possible. Attackers can...
hearbaseline (>=2021.0.3, <=2021.0.5), pydebiaseddta (0.1.0) +2 more potentially affected by CVE-2026-5241 via transformers (4.4.0)
transformers PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - hearbaseline =2021.0.3, =1.0.0a0, =0.6.20, =0.7.18 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...
hearbaseline (>=2021.0.3, <=2021.0.5), pydebiaseddta (0.1.0) +2 more potentially affected by CVE-2026-5241 via transformers (4.4.0)
transformers PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - hearbaseline =2021.0.3, =1.0.0a0, =0.6.20, =0.7.18 Source cves: CVE-2026-5241 Source advisory: OSV:PYSEC-2026-2290...
hearbaseline (>=2021.0.3, <=2021.0.5), pydebiaseddta (0.1.0) +2 more potentially affected by CVE-2026-1839 via transformers (4.4.0)
transformers PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - hearbaseline =2021.0.3, =1.0.0a0, =0.6.20, =0.7.18 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...
hearbaseline (>=2021.0.3, <=2021.0.5), pydebiaseddta (0.1.0) +2 more potentially affected by CVE-2026-1839 via transformers (4.4.0)
transformers PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - hearbaseline =2021.0.3, =1.0.0a0, =0.6.20, =0.7.18 Source cves: CVE-2026-1839 Source advisory: OSV:PYSEC-2026-2288...
hearbaseline (>=2021.0.3, <=2021.0.5), pydebiaseddta (0.1.0) +2 more potentially affected by CVE-2025-14929 via transformers (4.4.0)
transformers PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - hearbaseline =2021.0.3, =1.0.0a0, =0.6.20, =0.7.18 Source cves: CVE-2025-14929 Source advisory: OSV:PYSEC-2025-217...