CVE-2026-112145 | speaches-ai speaches up to 0.9.0-rc.3 Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn model externally-controlled input to select classes or code (Issue 679)

October 19, 2026 Yanac

A vulnerability identified as critical has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code.

This vulnerability is traded as CVE-2026-112145. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More