CVE-2026-10036: Speechbrain

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover_if_possible(). Attackers can embed malicious Python object construction tags such as !!python/object/apply in any CKPT.yaml file within the configured checkpoint path to trigger code execution during candidate discovery, even if the malicious checkpoint is never selected for recovery.

Affected products

• Speechbrain Speechbrain: before 1.1.1 (fixed in 1.1.1)

Published 2026-08-27. Last modified 2026-09-24.