## https://sploitus.com/exploit?id=1D83D313-D087-58D2-B743-0E81FFCD6980
# CVE-2026-10036: SpeechBrain Arbitrary Code Execution via CKPT.yaml Parsing
**Severity:** High, CVSS 4.0 **8.7**, CVSS 3.1 **8.8** (assigned by VulnCheck, the CNA)
**Vector (v4.0):** `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
**Vector (v3.1):** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
**Affected:** SpeechBrain ` list_checkpoints()
-> _construct_checkpoint_objects()
```
During checkpoint listing, SpeechBrain scans child directories named `CKPT*` that
contain `CKPT.yaml`. Each candidate metadata file is parsed before final
checkpoint selection.
The unsafe parse happens in `speechbrain.utils.checkpoints.checkpoints.py`:
```python
meta = yaml.load(fi, Loader=yaml.Loader)
```
The PoC creates two checkpoints:
- `CKPT+poisoned-metadata`: an older malicious checkpoint whose `CKPT.yaml`
contains a PyYAML object-apply payload.
- `CKPT+benign-newer`: a newer benign checkpoint that should be selected by
recency.
The benign checkpoint is selected, but the malicious checkpoint metadata still
executes during candidate listing. This demonstrates metadata parse-time code
execution independent of checkpoint restoration.
## Proof of Concept
[`package_builder.py`](./package_builder.py) creates the attacker-controlled
checkpoint layout.
[`run_poc.py`](./run_poc.py) runs the validation, calls
`Checkpointer.recover_if_possible()`, and prints execution evidence.
Run in a local test environment only:
```bash
python -m venv .venv
.venv\Scripts\activate
python -m pip install -r requirements.txt
python -B run_poc.py
```
Expected evidence on vulnerable versions:
```text
speechbrain_version: 1.1.0
installed_package: True
recovery_error: None
benign_checkpoint_selected: True
marker_before_recovery: False
marker_after_recovery: True
marker_contents:
speechbrain_checkpoint_yaml_loader_rce_triggered
success: True
```
The important evidence is that `benign_checkpoint_selected: True` and
`marker_after_recovery: True` appear together. This shows that the malicious
older checkpoint was not selected for recovery, but its metadata was still parsed
and executed while SpeechBrain listed checkpoint candidates.
The payload is intentionally harmless. It only writes this local marker string:
```text
speechbrain_checkpoint_yaml_loader_rce_triggered
```
It does not spawn a shell, connect to a network service, read secrets, delete
data, or modify files outside the PoC directory.
## Remediation
Upgrade to SpeechBrain `1.1.1` or later.
The durable code fix is to use PyYAML's safe loader for checkpoint metadata:
```python
yaml.safe_load(fi)
```
or:
```python
yaml.load(fi, Loader=yaml.SafeLoader)
```
Checkpoint metadata only needs scalar values such as `unixtime` and
`end-of-epoch`, so Python object construction should not be enabled for this
parse path.
If an immediate patch or upgrade is not available:
- Do not use checkpoint directories, model artifacts, or archives from untrusted
sources.
- Isolate SpeechBrain training and inference jobs with minimal privileges.
- Validate or reject unexpected tags and fields in `CKPT.yaml`.
- Avoid automatically resuming from externally supplied checkpoint directories.
## Credit
Discovered and reported by **Sai Teja Erukude**, coordinated through VulnCheck.
## References
- CVE Record: https://vulners.com/cve/CVE-2026-10036
- VulnCheck advisory: https://www.vulncheck.com/advisories/speechbrain-arbitrary-code-execution-via-ckpt-yaml-parsing
- Release notes: https://github.com/speechbrain/speechbrain/releases/tag/v1.1.1
- Pull request: https://github.com/speechbrain/speechbrain/pull/3067
- Patch commit: https://github.com/speechbrain/speechbrain/commit/22a616646a493871401461f80b2d5cf564cb2850
- PyYAML documentation: https://pyyaml.org/wiki/PyYAMLDocumentation
- Local walkthrough: [`exploit_walkthrough.md`](./exploit_walkthrough.md)