Summary
generated automatically from NVD dataspeaches-ai speaches up to 0.9.0-rc.3 contains a flaw in PyannoteDiarizationModelManager._load_fn, in src/speaches/executors/pyannote_diarization.py, part of the Pyannote Diarization Model Loading component. Manipulating the model argument lets externally controlled input select classes or code (CWE-470), and the attack can be launched remotely. The description says an exploit has been publicly disclosed and that the project has not yet responded to the issue report. The CVSS v3.1 score is 7.3 (HIGH).
NVD description
A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet.
EPSS · FIRST.org
0.43%probability of exploitation in the next 30 days
Higher than 35% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-20, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 19 oct. 2026
- Updated
- 19 oct. 2026
- Status
- Deferred
- Source
- cna@vuldb.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-470
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.