What happened
VulDB published (2026-10-19) a weakness in speaches-ai's Pyannote diarization model loading that lets a remotely-influenced model argument select code/classes, with a public PoC. CVSS 7.3 (v3.1) / 5.5 (v4.0), CWE-470, status Deferred.
Why it matters
speaches is a popular self-hosted OpenAI-compatible speech stack, so its model-loading path is reachable in deployed voice-AI services. Blindly trusting a model/class argument gives an attacker a code/class selection primitive in the inference path, though the practical blast radius is limited to niche self-hosted voice deployments.
Attack vector
The function PyannoteDiarizationModelManager._load_fn uses an externally-controlled input to select classes or code when loading the diarization model (CVE is a use-of-externally-controlled-input-to-select-classes-or-code flaw, CWE-470). A public PoC exists; the project has not yet responded.
Affected systems
speaches-ai speaches up to 0.9.0-rc.3 (Pyannote Diarization Model Loading)
Mitigation
No upstream fix yet (project informed, no response); restrict untrusted input to the model-selection path and monitor for the fix.