A fresh pip install pyannote-audio resolves lightning to 2.6.5, affected by CVE-2026-58659 (GHSA-qqmf-gpg7-g8gw, CVSS 7.8). A crafted checkpoint executes code on load. No fixed release has shipped. Treat third-party checkpoints as untrusted input until one does.
Summary
- What: eight pyannote models on Hugging Face, about 34 million downloads between them, inherit a HIGH remote code execution through
pyannote-audio, which pinslightning>=2.4with no ceiling. - Why it matters: the models never name lightning, and neither does any tool that stops at the manifest. The declared surface is clean; the installed surface is not.
- What to do: load checkpoints only from sources you control, in isolation; watch the upstream fix; if you publish a package, put a ceiling on floor-only pins.
What happened
Speaker diarization is the layer under call transcription, meeting notes and compliance recording: who spoke, and when. pyannote's models are a default choice. Each declares exactly one Python dependency, pyannote-audio, whose current release 4.0.7 (June 30, 2026) is clean by every advisory we hold.
On July 15, 2026 GitHub published GHSA-qqmf-gpg7-g8gw, CVE-2026-58659, against PyTorch Lightning. The _load_state routine imports and executes whatever module name a checkpoint's _instantiator hyperparameter points at. Every released version through the current 2.6.5 is affected; the fix exists as a commit, not a release. pyannote-audio requires lightning>=2.4, a floor with no ceiling, so a fresh install lands on the vulnerable version today.
The package you named is clean. The one it pulls is not. A manifest cannot tell you the difference.
The models never name lightning, and pyannote-audio has no advisory against it. A scanner that reads requirements files and stops there reports eight clean models. That is the boundary of what a manifest can tell you, not a bug in those tools.
The attack chain
pyannote-audio 4.0.7 releases with lightning>=2.4. Checked alone, it fires no signal.
GHSA-qqmf-gpg7-g8gw: a checkpoint's hyperparameters can name a module that lightning imports and runs on load.
No upper bound, so every fresh install resolves lightning to 2.6.5, which the advisory covers.
A colleague passes along a fine-tuned checkpoint that works better on our accents. Checkpoints are files; people trade them.
The pipeline loads the checkpoint through lightning. _load_state imports the module the file names. Code executes with the pipeline's privileges.
CyberXYZ resolves each model to the whole install. The path from a pyannote model through pyannote-audio to lightning 2.6.5 is depth one, required, version-confirmed. Eight models move from CLEAN to HIGH, with the reason recorded.
Indicators
| Type | Indicator | Context |
|---|---|---|
| Package | lightning <= 2.6.5 | Every released version; no fixed release as of September 7, 2026 |
| Advisory | GHSA-qqmf-gpg7-g8gw | CVE-2026-58659, CVSS 7.8, CWE-470 unsafe reflection |
| Sink | lightning._load_state | Imports the module named in a checkpoint's _instantiator hyperparameter |
| Carrier | *.ckpt / *.pt | Any checkpoint whose hyperparameters carry a module path outside Lightning's own namespaces |
| Pin | lightning>=2.4 | Declared by pyannote-audio 4.0.7; admits the vulnerable release |
| Models | pyannote/* | speaker-diarization-3.1, wespeaker-voxceleb-resnet34-LM, segmentation-3.0, speaker-diarization-community-1, segmentation, voice-activity-detection, embedding, speaker-diarization |
No hashes or hosts are listed because none were observed in an attack. These indicators describe the exposure, not an intrusion.
MITRE mapping
On MITRE ATLAS, the matrix for attacks on AI systems, this is a supply-chain compromise of the model artifact that ends in a user executing an unsafe artifact. On ATT&CK it is a software-dependency compromise triggered by a malicious file.
How CyberXYZ sees it
We do not stop at the manifest. Every watched model is resolved to its transitive closure at the versions that install today, and each reachable package is checked against advisories only when the resolved version is in range and the path is required. Asked about pyannote-audio@4.0.7 alone, the engine fires nothing. Asked about lightning@2.6.5, it answers alert, XYZ score 4.2, with the advisory named. The fleet view now rates the eight pyannote models HIGH and files them under one attack vector: vulnerable by inheritance. The full step-by-step, with the platform's own verdict card, is in the case study.
Recommended actions
Inventory environments that resolve lightning at any 2.x and load checkpoints from outside your control. Load third-party checkpoints only in isolation. Inspect _instantiator values in checkpoint hyperparameters; anything outside lightning.* or pytorch_lightning.* is suspect.
Short term: watch the upstream fix and constrain lightning the moment a fixed release ships. Long term: resolve your models to the whole install, not the manifest, and ask package maintainers to put ceilings on floor-only pins.
References
- GitHub Security Advisory, GHSA-qqmf-gpg7-g8gw
- NIST NVD, CVE-2026-58659
- MITRE ATLAS, AML.T0010.003 and AML.T0011.000
- MITRE ATT&CK, T1195.001
- CyberXYZ, Case study: pyannote and the package it never named