CVE-2026-112145

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112145

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112145.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112145

Published

2026-10-19T13:45:17Z

Modified

2026-10-20T02:45:31Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code

Details

A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced in PR #628 (feat/switch to pyannote audio), merged as commit 870e1e16a73452496e99d49f759eabd692a8e0e0. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-470"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112145.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "0.9.0-rc.0"
                },
                {
                    "last_affected":  "0.9.0-rc.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/speaches-ai/speaches

Affected ranges

Type

GIT

Repo

https://github.com/speaches-ai/speaches

Events

Introduced

195a18d64abdb5955d41a3b56f48929b04d7b35e

Last Affected

24f209c90218187747a9205f0b84bc06b42ce775

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.9.0-rc.1"
        },
        {
            "last_affected":  "0.9.0-rc.1"
        },
        {
            "introduced":  "0.9.0-rc.2"
        },
        {
            "last_affected":  "0.9.0-rc.2"
        },
        {
            "introduced":  "0.9.0-rc.3"
        },
        {
            "last_affected":  "0.9.0-rc.3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*

0.9.0-rc.1

0.9.0-rc.2

0.9.0-rc.3

v0.*

v0.9.0-rc.1

v0.9.0-rc.2

v0.9.0-rc.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112145.json"