CVE-2026-10036 - SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover_if_possible(). Attackers can embed malicious Python object construction tags such as !!python/object/apply in any CKPT.yaml file within the configured checkpoint path to trigger code execution during candidate dis - 漏洞详情

漏洞编号：CVE-2026-10036

风险等级：高危

漏洞来源：CVE

CVE 编号：CVE-2026-10036

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-502

发布/更新时间：2026-08-27 / 2026-08-27

漏洞描述

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover_if_possible(). Attackers can embed malicious Python object construction tags such as !!python/object/apply in any CKPT.yaml file within the configured checkpoint path to trigger code execution during candidate discovery, even if the malicious checkpoint is never selected for recovery.

漏洞描述

相关链接

相关漏洞