An attacker who can supply or modify a SpeechBrain checkpoint directory can place a malicious CKPT.yaml file inside a CKPT* checkpoint directory. When a victim calls Checkpointer.recover_if_possible(), SpeechBrain lists checkpoint candidates and parses every candidate metadata file with:

Because yaml.Loader supports Python object construction tags such as !!python/object/apply, attacker-controlled checkpoint metadata can execute Python code during checkpoint discovery.

The malicious checkpoint does not need to be selected or restored. Code execution occurs while SpeechBrain is enumerating checkpoint candidates.

Impact

An attacker may execute arbitrary Python code in the context of the Python process running SpeechBrain.

This can affect workflows where users download, unpack, resume, or run training/inference from untrusted checkpoint directories, model artifacts, or archives.

Depending on the hosting process, this may allow:

• Reading or modifying files accessible to the process.
• Accessing environment variables and application secrets.
• Calling internal services reachable from the host.
• Disrupting training, inference, or automation jobs.

Technical Detail

The affected component is SpeechBrain's checkpoint recovery/listing flow:

During checkpoint listing, SpeechBrain scans child directories named CKPT* that contain CKPT.yaml. Each candidate metadata file is parsed before final checkpoint selection.

The unsafe parse happens in speechbrain.utils.checkpoints.checkpoints.py:

The PoC creates two checkpoints:

• CKPT+poisoned-metadata: an older malicious checkpoint whose CKPT.yaml contains a PyYAML object-apply payload.
• CKPT+benign-newer: a newer benign checkpoint that should be selected by recency.

The benign checkpoint is selected, but the malicious checkpoint metadata still executes during candidate listing. This demonstrates metadata parse-time code execution independent of checkpoint restoration.

Proof of Concept

package_builder.py creates the attacker-controlled checkpoint layout.

run_poc.py runs the validation, calls Checkpointer.recover_if_possible(), and prints execution evidence.

Run in a local test environment only:

Expected evidence on vulnerable versions:

The important evidence is that benign_checkpoint_selected: True and marker_after_recovery: True appear together. This shows that the malicious older checkpoint was not selected for recovery, but its metadata was still parsed and executed while SpeechBrain listed checkpoint candidates.

The payload is intentionally harmless. It only writes this local marker string:

It does not spawn a shell, connect to a network service, read secrets, delete data, or modify files outside the PoC directory.

Remediation

Upgrade to SpeechBrain 1.1.1 or later.

The durable code fix is to use PyYAML's safe loader for checkpoint metadata:

or:

Checkpoint metadata only needs scalar values such as unixtime and end-of-epoch, so Python object construction should not be enabled for this parse path.

If an immediate patch or upgrade is not available:

• Do not use checkpoint directories, model artifacts, or archives from untrusted sources.
• Isolate SpeechBrain training and inference jobs with minimal privileges.
• Validate or reject unexpected tags and fields in CKPT.yaml.
• Avoid automatically resuming from externally supplied checkpoint directories.

Credit

Discovered and reported by Sai Teja Erukude, coordinated through VulnCheck.

References

• CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-10036
• VulnCheck advisory: https://www.vulncheck.com/advisories/speechbrain-arbitrary-code-execution-via-ckpt-yaml-parsing
• Release notes: https://github.com/speechbrain/speechbrain/releases/tag/v1.1.1
• Pull request: https://github.com/speechbrain/speechbrain/pull/3067
• Patch commit: https://github.com/speechbrain/speechbrain/commit/22a616646a493871401461f80b2d5cf564cb2850
• PyYAML documentation: https://pyyaml.org/wiki/PyYAMLDocumentation
• Local walkthrough: exploit_walkthrough.md