CVE-2026-10036

Name of the Vulnerable Software and Affected Versions SpeechBrain versions prior to 1.1.1

Description An arbitrary code execution issue exists when the software parses a crafted CKPT.yaml checkpoint metadata file using PyYAML's unsafe loader during candidate enumeration in the recover if possible() function. Attackers can embed malicious Python object construction tags, such as !!python/object/apply, within any CKPT.yaml file located in the configured checkpoint path. This allows for code execution during the candidate discovery process, regardless of whether the malicious checkpoint is actually selected for recovery.

Recommendations Update SpeechBrain to version 1.1.1 or later.