emreefedogan/speechbrain-ckpt-rce-poc

SpeechBrain checkpoint RCE PoC (unsafe yaml.load(Loader=yaml.Loader))

Security proof-of-concept for a Model File Vulnerability in speechbrain.

A SpeechBrain checkpoint is a directory whose name starts with CKPT and which contains a CKPT.yaml metadata file. When SpeechBrain recovers a checkpoint, it parses CKPT.yaml with PyYAML's full loader (speechbrain/utils/checkpoints.py → Checkpointer._construct_checkpoint_objects: meta = yaml.load(fi, Loader=yaml.Loader)). The full loader constructs arbitrary Python objects, so a malicious CKPT.yaml executes code the moment a victim loads/resumes this checkpoint.

Contents

• CKPT+2026-07-27+00-00-00+00/CKPT.yaml — malicious checkpoint metadata (benign payload: runs id)
• CKPT+2026-07-27+00-00-00+00/model.ckpt — placeholder param file
• trigger.py — the victim action

Reproduce

pip install speechbrain
python trigger.py .
cat /tmp/speechbrain_mfv_poc.txt   # <- output of `id`, i.e. code executed at load time

The payload here is harmless (id > /tmp/speechbrain_mfv_poc.txt). A real attacker would run arbitrary commands as the user loading the checkpoint.

huntr note: host this in a gated HuggingFace repo and grant access to protectai-bot.

Impact

Arbitrary code execution when loading/resuming an untrusted SpeechBrain checkpoint. Affects speechbrain 1.1.0 and current develop.

Fix

Use yaml.safe_load(fi) — CKPT.yaml only holds scalar metadata.